diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e4291ce10..1bd6bcb15 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,6 +11,8 @@ on:
 jobs:
   ci:
     uses: upbound/uptest/.github/workflows/provider-ci.yml@main
+    with:
+      go-version: 1.21
     secrets:
       UPBOUND_MARKETPLACE_PUSH_ROBOT_USR: ${{ secrets.UPBOUND_MARKETPLACE_PUSH_ROBOT_USR }}
       UPBOUND_MARKETPLACE_PUSH_ROBOT_PSW: ${{ secrets.UPBOUND_MARKETPLACE_PUSH_ROBOT_PSW }}
diff --git a/.github/workflows/native-provider-bump.yml b/.github/workflows/native-provider-bump.yml
index 2d170c513..1bbfd2fda 100644
--- a/.github/workflows/native-provider-bump.yml
+++ b/.github/workflows/native-provider-bump.yml
@@ -8,6 +8,6 @@ jobs:
     uses: upbound/uptest/.github/workflows/native-provider-bump.yml@main
     with:
       provider-source: hashicorp/google
-      go-version: 1.19
+      go-version: 1.21
     secrets:
       TOKEN: ${{ secrets.OFFICIAL_PROVIDERS_GA_TOKEN }}
diff --git a/.github/workflows/publish-service-artifacts.yml b/.github/workflows/publish-service-artifacts.yml
index 59481c1c0..ec4f2aaff 100644
--- a/.github/workflows/publish-service-artifacts.yml
+++ b/.github/workflows/publish-service-artifacts.yml
@@ -23,6 +23,7 @@ jobs:
       subpackages: ${{ github.event.inputs.subpackages }}
       size: ${{ github.event.inputs.size }}
       concurrency: ${{ github.event.inputs.concurrency }}
+      go-version: 1.21
     secrets:
       UPBOUND_MARKETPLACE_PUSH_ROBOT_USR: ${{ secrets.UPBOUND_MARKETPLACE_PUSH_ROBOT_USR_RC }}
       UPBOUND_MARKETPLACE_PUSH_ROBOT_PSW: ${{ secrets.UPBOUND_MARKETPLACE_PUSH_ROBOT_PSW_RC }}
diff --git a/.github/workflows/updoc.yml b/.github/workflows/updoc.yml
index 9cbde3c9f..767495349 100644
--- a/.github/workflows/updoc.yml
+++ b/.github/workflows/updoc.yml
@@ -8,5 +8,6 @@ jobs:
     uses: upbound/uptest/.github/workflows/provider-updoc.yml@main
     with:
       providers: "monolith config"
+      go-version: 1.21
     secrets:
       UPBOUND_CI_PROD_BUCKET_SA: ${{ secrets.UPBOUND_CI_PROD_BUCKET_SA }}
diff --git a/.github/workflows/uptest-all.yml b/.github/workflows/uptest-all.yml
index 4abc43a9e..4e4ace9ae 100644
--- a/.github/workflows/uptest-all.yml
+++ b/.github/workflows/uptest-all.yml
@@ -5,7 +5,7 @@ on:
 
 env:
   # Common versions
-  GO_VERSION: '1.19'
+  GO_VERSION: '1.21'
   DOCKER_BUILDX_VERSION: 'v0.8.2'
 
 jobs:
diff --git a/Makefile b/Makefile
index acead6aa6..c4614834a 100644
--- a/Makefile
+++ b/Makefile
@@ -45,7 +45,7 @@ GO_TEST_PARALLEL := $(shell echo $$(( $(NPROCS) / 2 )))
 # correctly.
 export GOPRIVATE = github.com/upbound/*
 
-GO_REQUIRED_VERSION ?= 1.19
+GO_REQUIRED_VERSION ?= 1.21
 # GOLANGCILINT_VERSION is inherited from build submodule by default.
 # Uncomment below if you need to override the version.
 # GOLANGCILINT_VERSION ?= 1.54.0
@@ -65,7 +65,7 @@ export SUBPACKAGES := $(SUBPACKAGES)
 # Setup Kubernetes tools
 
 KIND_VERSION = v0.15.0
-UPTEST_VERSION = v0.6.1
+UPTEST_VERSION = v0.8.0
 # dependency for up
 UP_VERSION = v0.20.0
 UP_CHANNEL = stable
@@ -246,7 +246,7 @@ crddiff: $(UPTEST)
 			continue ; \
 		fi ; \
 		echo "Checking $${crd} for breaking API changes..." ; \
-		changes_detected=$$($(UPTEST) crddiff revision <(git cat-file -p "$${GITHUB_BASE_REF}:$${crd}") "$${crd}" 2>&1) ; \
+		changes_detected=$$($(UPTEST) crddiff revision --enable-upjet-extensions <(git cat-file -p "$${GITHUB_BASE_REF}:$${crd}") "$${crd}" 2>&1) ; \
 		if [[ $$? != 0 ]] ; then \
 			printf "\033[31m"; echo "Breaking change detected!"; printf "\033[0m" ; \
 			echo "$${changes_detected}" ; \
diff --git a/apis/accesscontextmanager/v1beta1/zz_generated_terraformed.go b/apis/accesscontextmanager/v1beta1/zz_generated_terraformed.go
index 4cfba696b..fc742f4f6 100755
--- a/apis/accesscontextmanager/v1beta1/zz_generated_terraformed.go
+++ b/apis/accesscontextmanager/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *AccessLevel) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this AccessLevel
+func (tr *AccessLevel) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this AccessLevel using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *AccessLevel) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *AccessLevelCondition) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this AccessLevelCondition
+func (tr *AccessLevelCondition) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this AccessLevelCondition using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *AccessLevelCondition) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *AccessPolicy) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this AccessPolicy
+func (tr *AccessPolicy) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this AccessPolicy using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *AccessPolicy) LateInitialize(attrs []byte) (bool, error) {
@@ -347,6 +438,36 @@ func (tr *AccessPolicyIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this AccessPolicyIAMMember
+func (tr *AccessPolicyIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this AccessPolicyIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *AccessPolicyIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -431,6 +552,36 @@ func (tr *ServicePerimeter) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ServicePerimeter
+func (tr *ServicePerimeter) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ServicePerimeter using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ServicePerimeter) LateInitialize(attrs []byte) (bool, error) {
@@ -515,6 +666,36 @@ func (tr *ServicePerimeterResource) GetInitParameters() (map[string]any, error)
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ServicePerimeterResource
+func (tr *ServicePerimeterResource) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ServicePerimeterResource using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ServicePerimeterResource) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/accesscontextmanager/v1beta1/zz_serviceperimeter_types.go b/apis/accesscontextmanager/v1beta1/zz_serviceperimeter_types.go
index 375caa870..6613e92c4 100755
--- a/apis/accesscontextmanager/v1beta1/zz_serviceperimeter_types.go
+++ b/apis/accesscontextmanager/v1beta1/zz_serviceperimeter_types.go
@@ -1420,6 +1420,7 @@ type StatusInitParameters struct {
 	// storage.googleapis.com is specified, access to the storage
 	// buckets inside the perimeter must meet the perimeter's access
 	// restrictions.
+	// +listType=set
 	RestrictedServices []*string `json:"restrictedServices,omitempty" tf:"restricted_services,omitempty"`
 
 	// Specifies how APIs are allowed to communicate within the Service
@@ -1465,6 +1466,7 @@ type StatusObservation struct {
 	// storage.googleapis.com is specified, access to the storage
 	// buckets inside the perimeter must meet the perimeter's access
 	// restrictions.
+	// +listType=set
 	RestrictedServices []*string `json:"restrictedServices,omitempty" tf:"restricted_services,omitempty"`
 
 	// Specifies how APIs are allowed to communicate within the Service
@@ -1524,6 +1526,7 @@ type StatusParameters struct {
 	// buckets inside the perimeter must meet the perimeter's access
 	// restrictions.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	RestrictedServices []*string `json:"restrictedServices,omitempty" tf:"restricted_services,omitempty"`
 
 	// Specifies how APIs are allowed to communicate within the Service
@@ -1537,6 +1540,7 @@ type StatusVPCAccessibleServicesInitParameters struct {
 
 	// The list of APIs usable within the Service Perimeter.
 	// Must be empty unless enableRestriction is True.
+	// +listType=set
 	AllowedServices []*string `json:"allowedServices,omitempty" tf:"allowed_services,omitempty"`
 
 	// Whether to restrict API calls within the Service Perimeter to the
@@ -1548,6 +1552,7 @@ type StatusVPCAccessibleServicesObservation struct {
 
 	// The list of APIs usable within the Service Perimeter.
 	// Must be empty unless enableRestriction is True.
+	// +listType=set
 	AllowedServices []*string `json:"allowedServices,omitempty" tf:"allowed_services,omitempty"`
 
 	// Whether to restrict API calls within the Service Perimeter to the
@@ -1560,6 +1565,7 @@ type StatusVPCAccessibleServicesParameters struct {
 	// The list of APIs usable within the Service Perimeter.
 	// Must be empty unless enableRestriction is True.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	AllowedServices []*string `json:"allowedServices,omitempty" tf:"allowed_services,omitempty"`
 
 	// Whether to restrict API calls within the Service Perimeter to the
diff --git a/apis/activedirectory/v1beta1/zz_domain_types.go b/apis/activedirectory/v1beta1/zz_domain_types.go
index 498346369..92c8c7c55 100755
--- a/apis/activedirectory/v1beta1/zz_domain_types.go
+++ b/apis/activedirectory/v1beta1/zz_domain_types.go
@@ -37,6 +37,7 @@ type DomainInitParameters struct {
 
 	// The full names of the Google Compute Engine networks the domain instance is connected to. The domain is only available on networks listed in authorizedNetworks.
 	// If CIDR subnets overlap between networks, domain creation will fail.
+	// +listType=set
 	AuthorizedNetworks []*string `json:"authorizedNetworks,omitempty" tf:"authorized_networks,omitempty"`
 
 	// The fully qualified domain name. e.g. mydomain.myorganization.com, with the restrictions,
@@ -44,6 +45,7 @@ type DomainInitParameters struct {
 	DomainName *string `json:"domainName,omitempty" tf:"domain_name,omitempty"`
 
 	// Resource labels that can contain user-provided metadata
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Locations where domain needs to be provisioned. [regions][compute/docs/regions-zones/]
@@ -67,6 +69,7 @@ type DomainObservation struct {
 
 	// The full names of the Google Compute Engine networks the domain instance is connected to. The domain is only available on networks listed in authorizedNetworks.
 	// If CIDR subnets overlap between networks, domain creation will fail.
+	// +listType=set
 	AuthorizedNetworks []*string `json:"authorizedNetworks,omitempty" tf:"authorized_networks,omitempty"`
 
 	// The fully qualified domain name. e.g. mydomain.myorganization.com, with the restrictions,
@@ -81,6 +84,7 @@ type DomainObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// Resource labels that can contain user-provided metadata
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Locations where domain needs to be provisioned. [regions][compute/docs/regions-zones/]
@@ -109,6 +113,7 @@ type DomainParameters struct {
 	// The full names of the Google Compute Engine networks the domain instance is connected to. The domain is only available on networks listed in authorizedNetworks.
 	// If CIDR subnets overlap between networks, domain creation will fail.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	AuthorizedNetworks []*string `json:"authorizedNetworks,omitempty" tf:"authorized_networks,omitempty"`
 
 	// The fully qualified domain name. e.g. mydomain.myorganization.com, with the restrictions,
@@ -118,6 +123,7 @@ type DomainParameters struct {
 
 	// Resource labels that can contain user-provided metadata
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Locations where domain needs to be provisioned. [regions][compute/docs/regions-zones/]
diff --git a/apis/activedirectory/v1beta1/zz_generated_terraformed.go b/apis/activedirectory/v1beta1/zz_generated_terraformed.go
index 54ed3b8bf..66cb0735f 100755
--- a/apis/activedirectory/v1beta1/zz_generated_terraformed.go
+++ b/apis/activedirectory/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Domain) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Domain
+func (tr *Domain) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Domain using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Domain) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/alloydb/v1beta1/zz_backup_types.go b/apis/alloydb/v1beta1/zz_backup_types.go
index 9e7967df3..f8b49b171 100755
--- a/apis/alloydb/v1beta1/zz_backup_types.go
+++ b/apis/alloydb/v1beta1/zz_backup_types.go
@@ -39,6 +39,7 @@ type BackupInitParameters struct {
 	EncryptionConfig []EncryptionConfigInitParameters `json:"encryptionConfig,omitempty" tf:"encryption_config,omitempty"`
 
 	// User-defined labels for the alloydb backup.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -72,6 +73,7 @@ type BackupObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// User-defined labels for the alloydb backup.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The location where the alloydb backup should reside.
@@ -124,6 +126,7 @@ type BackupParameters struct {
 
 	// User-defined labels for the alloydb backup.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The location where the alloydb backup should reside.
diff --git a/apis/alloydb/v1beta1/zz_cluster_types.go b/apis/alloydb/v1beta1/zz_cluster_types.go
index 8278cf396..d91a91ab6 100755
--- a/apis/alloydb/v1beta1/zz_cluster_types.go
+++ b/apis/alloydb/v1beta1/zz_cluster_types.go
@@ -63,6 +63,7 @@ type AutomatedBackupPolicyInitParameters struct {
 	EncryptionConfig []AutomatedBackupPolicyEncryptionConfigInitParameters `json:"encryptionConfig,omitempty" tf:"encryption_config,omitempty"`
 
 	// Labels to apply to backups created using this configuration.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Quantity-based Backup retention policy to retain recent backups. Conflicts with 'time_based_retention', both can't be set together.
@@ -93,6 +94,7 @@ type AutomatedBackupPolicyObservation struct {
 	EncryptionConfig []AutomatedBackupPolicyEncryptionConfigObservation `json:"encryptionConfig,omitempty" tf:"encryption_config,omitempty"`
 
 	// Labels to apply to backups created using this configuration.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The location where the backup will be stored. Currently, the only supported option is to store the backup in the same region as the cluster.
@@ -130,6 +132,7 @@ type AutomatedBackupPolicyParameters struct {
 
 	// Labels to apply to backups created using this configuration.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The location where the backup will be stored. Currently, the only supported option is to store the backup in the same region as the cluster.
@@ -223,6 +226,7 @@ type ClusterInitParameters struct {
 	InitialUser []InitialUserInitParameters `json:"initialUser,omitempty" tf:"initial_user,omitempty"`
 
 	// User-defined labels for the alloydb cluster.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -271,6 +275,7 @@ type ClusterObservation struct {
 	InitialUser []InitialUserObservation `json:"initialUser,omitempty" tf:"initial_user,omitempty"`
 
 	// User-defined labels for the alloydb cluster.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The location where the alloydb cluster should reside.
@@ -324,6 +329,7 @@ type ClusterParameters struct {
 
 	// User-defined labels for the alloydb cluster.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The location where the alloydb cluster should reside.
diff --git a/apis/alloydb/v1beta1/zz_generated_terraformed.go b/apis/alloydb/v1beta1/zz_generated_terraformed.go
index 2f0fdd631..af8abd61d 100755
--- a/apis/alloydb/v1beta1/zz_generated_terraformed.go
+++ b/apis/alloydb/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Backup) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Backup
+func (tr *Backup) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Backup using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Backup) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *Cluster) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Cluster
+func (tr *Cluster) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Cluster using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Cluster) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *Instance) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Instance
+func (tr *Instance) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Instance using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Instance) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/alloydb/v1beta1/zz_instance_types.go b/apis/alloydb/v1beta1/zz_instance_types.go
index 25ac172ab..2390ebdcf 100755
--- a/apis/alloydb/v1beta1/zz_instance_types.go
+++ b/apis/alloydb/v1beta1/zz_instance_types.go
@@ -32,6 +32,7 @@ import (
 type InstanceInitParameters struct {
 
 	// Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels.
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// 'Availability type of an Instance. Defaults to REGIONAL for both primary and read instances.
@@ -44,6 +45,7 @@ type InstanceInitParameters struct {
 	AvailabilityType *string `json:"availabilityType,omitempty" tf:"availability_type,omitempty"`
 
 	// Database flags. Set at instance level. * They are copied from primary instance on read instance creation. * Read instances can set new or override existing flags that are relevant for reads, e.g. for enabling columnar cache on a read instance. Flags set on read instance may or may not be present on primary.
+	// +mapType=granular
 	DatabaseFlags map[string]*string `json:"databaseFlags,omitempty" tf:"database_flags,omitempty"`
 
 	// User-settable and human-readable display name for the Instance.
@@ -57,6 +59,7 @@ type InstanceInitParameters struct {
 	InstanceType *string `json:"instanceType,omitempty" tf:"instance_type,omitempty"`
 
 	// User-defined labels for the alloydb instance.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Configurations for the machines that host the underlying database engine.
@@ -71,6 +74,7 @@ type InstanceInitParameters struct {
 type InstanceObservation struct {
 
 	// Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels.
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// 'Availability type of an Instance. Defaults to REGIONAL for both primary and read instances.
@@ -90,6 +94,7 @@ type InstanceObservation struct {
 	CreateTime *string `json:"createTime,omitempty" tf:"create_time,omitempty"`
 
 	// Database flags. Set at instance level. * They are copied from primary instance on read instance creation. * Read instances can set new or override existing flags that are relevant for reads, e.g. for enabling columnar cache on a read instance. Flags set on read instance may or may not be present on primary.
+	// +mapType=granular
 	DatabaseFlags map[string]*string `json:"databaseFlags,omitempty" tf:"database_flags,omitempty"`
 
 	// User-settable and human-readable display name for the Instance.
@@ -109,6 +114,7 @@ type InstanceObservation struct {
 	InstanceType *string `json:"instanceType,omitempty" tf:"instance_type,omitempty"`
 
 	// User-defined labels for the alloydb instance.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Configurations for the machines that host the underlying database engine.
@@ -139,6 +145,7 @@ type InstanceParameters struct {
 
 	// Annotations to allow client tools to store small amount of arbitrary data. This is distinct from labels.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// 'Availability type of an Instance. Defaults to REGIONAL for both primary and read instances.
@@ -168,6 +175,7 @@ type InstanceParameters struct {
 
 	// Database flags. Set at instance level. * They are copied from primary instance on read instance creation. * Read instances can set new or override existing flags that are relevant for reads, e.g. for enabling columnar cache on a read instance. Flags set on read instance may or may not be present on primary.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	DatabaseFlags map[string]*string `json:"databaseFlags,omitempty" tf:"database_flags,omitempty"`
 
 	// User-settable and human-readable display name for the Instance.
@@ -185,6 +193,7 @@ type InstanceParameters struct {
 
 	// User-defined labels for the alloydb instance.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Configurations for the machines that host the underlying database engine.
diff --git a/apis/apigee/v1beta1/zz_generated_terraformed.go b/apis/apigee/v1beta1/zz_generated_terraformed.go
index ea22d1481..c847baf80 100755
--- a/apis/apigee/v1beta1/zz_generated_terraformed.go
+++ b/apis/apigee/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Envgroup) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Envgroup
+func (tr *Envgroup) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Envgroup using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Envgroup) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *Environment) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Environment
+func (tr *Environment) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Environment using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Environment) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *EnvironmentIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this EnvironmentIAMMember
+func (tr *EnvironmentIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this EnvironmentIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *EnvironmentIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -347,6 +438,36 @@ func (tr *Instance) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Instance
+func (tr *Instance) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Instance using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Instance) LateInitialize(attrs []byte) (bool, error) {
@@ -431,6 +552,36 @@ func (tr *NATAddress) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this NATAddress
+func (tr *NATAddress) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this NATAddress using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *NATAddress) LateInitialize(attrs []byte) (bool, error) {
@@ -515,6 +666,36 @@ func (tr *Organization) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Organization
+func (tr *Organization) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Organization using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Organization) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/appengine/v1beta1/zz_generated_terraformed.go b/apis/appengine/v1beta1/zz_generated_terraformed.go
index 068c7f27a..5c99aaf57 100755
--- a/apis/appengine/v1beta1/zz_generated_terraformed.go
+++ b/apis/appengine/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Application) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Application
+func (tr *Application) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Application using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Application) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *ApplicationURLDispatchRules) GetInitParameters() (map[string]any, erro
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ApplicationURLDispatchRules
+func (tr *ApplicationURLDispatchRules) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ApplicationURLDispatchRules using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ApplicationURLDispatchRules) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *FirewallRule) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this FirewallRule
+func (tr *FirewallRule) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this FirewallRule using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *FirewallRule) LateInitialize(attrs []byte) (bool, error) {
@@ -347,6 +438,36 @@ func (tr *ServiceNetworkSettings) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ServiceNetworkSettings
+func (tr *ServiceNetworkSettings) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ServiceNetworkSettings using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ServiceNetworkSettings) LateInitialize(attrs []byte) (bool, error) {
@@ -431,6 +552,36 @@ func (tr *StandardAppVersion) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this StandardAppVersion
+func (tr *StandardAppVersion) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this StandardAppVersion using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *StandardAppVersion) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/appengine/v1beta1/zz_standardappversion_types.go b/apis/appengine/v1beta1/zz_standardappversion_types.go
index 83bb911b1..cb6e29a38 100755
--- a/apis/appengine/v1beta1/zz_standardappversion_types.go
+++ b/apis/appengine/v1beta1/zz_standardappversion_types.go
@@ -439,6 +439,7 @@ type StandardAppVersionInitParameters struct {
 	Entrypoint []EntrypointInitParameters `json:"entrypoint,omitempty" tf:"entrypoint,omitempty"`
 
 	// Environment variables available to the application.
+	// +mapType=granular
 	EnvVariables map[string]*string `json:"envVariables,omitempty" tf:"env_variables,omitempty"`
 
 	// An ordered list of URL-matching patterns that should be applied to incoming requests.
@@ -448,6 +449,7 @@ type StandardAppVersionInitParameters struct {
 
 	// A list of the types of messages that this application is able to receive.
 	// Each value may be one of: INBOUND_SERVICE_MAIL, INBOUND_SERVICE_MAIL_BOUNCE, INBOUND_SERVICE_XMPP_ERROR, INBOUND_SERVICE_XMPP_MESSAGE, INBOUND_SERVICE_XMPP_SUBSCRIBE, INBOUND_SERVICE_XMPP_PRESENCE, INBOUND_SERVICE_CHANNEL_PRESENCE, INBOUND_SERVICE_WARMUP.
+	// +listType=set
 	InboundServices []*string `json:"inboundServices,omitempty" tf:"inbound_services,omitempty"`
 
 	// Instance class that is used to run this version. Valid values are
@@ -512,6 +514,7 @@ type StandardAppVersionObservation struct {
 	Entrypoint []EntrypointObservation `json:"entrypoint,omitempty" tf:"entrypoint,omitempty"`
 
 	// Environment variables available to the application.
+	// +mapType=granular
 	EnvVariables map[string]*string `json:"envVariables,omitempty" tf:"env_variables,omitempty"`
 
 	// An ordered list of URL-matching patterns that should be applied to incoming requests.
@@ -524,6 +527,7 @@ type StandardAppVersionObservation struct {
 
 	// A list of the types of messages that this application is able to receive.
 	// Each value may be one of: INBOUND_SERVICE_MAIL, INBOUND_SERVICE_MAIL_BOUNCE, INBOUND_SERVICE_XMPP_ERROR, INBOUND_SERVICE_XMPP_MESSAGE, INBOUND_SERVICE_XMPP_SUBSCRIBE, INBOUND_SERVICE_XMPP_PRESENCE, INBOUND_SERVICE_CHANNEL_PRESENCE, INBOUND_SERVICE_WARMUP.
+	// +listType=set
 	InboundServices []*string `json:"inboundServices,omitempty" tf:"inbound_services,omitempty"`
 
 	// Instance class that is used to run this version. Valid values are
@@ -604,6 +608,7 @@ type StandardAppVersionParameters struct {
 
 	// Environment variables available to the application.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	EnvVariables map[string]*string `json:"envVariables,omitempty" tf:"env_variables,omitempty"`
 
 	// An ordered list of URL-matching patterns that should be applied to incoming requests.
@@ -615,6 +620,7 @@ type StandardAppVersionParameters struct {
 	// A list of the types of messages that this application is able to receive.
 	// Each value may be one of: INBOUND_SERVICE_MAIL, INBOUND_SERVICE_MAIL_BOUNCE, INBOUND_SERVICE_XMPP_ERROR, INBOUND_SERVICE_XMPP_MESSAGE, INBOUND_SERVICE_XMPP_SUBSCRIBE, INBOUND_SERVICE_XMPP_PRESENCE, INBOUND_SERVICE_CHANNEL_PRESENCE, INBOUND_SERVICE_WARMUP.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	InboundServices []*string `json:"inboundServices,omitempty" tf:"inbound_services,omitempty"`
 
 	// Instance class that is used to run this version. Valid values are
@@ -743,6 +749,7 @@ type StaticFilesInitParameters struct {
 
 	// HTTP headers to use for all responses from these URLs.
 	// An object containing a list of "key:value" value pairs.".
+	// +mapType=granular
 	HTTPHeaders map[string]*string `json:"httpHeaders,omitempty" tf:"http_headers,omitempty"`
 
 	// MIME type used to serve all files served by this handler.
@@ -772,6 +779,7 @@ type StaticFilesObservation struct {
 
 	// HTTP headers to use for all responses from these URLs.
 	// An object containing a list of "key:value" value pairs.".
+	// +mapType=granular
 	HTTPHeaders map[string]*string `json:"httpHeaders,omitempty" tf:"http_headers,omitempty"`
 
 	// MIME type used to serve all files served by this handler.
@@ -804,6 +812,7 @@ type StaticFilesParameters struct {
 	// HTTP headers to use for all responses from these URLs.
 	// An object containing a list of "key:value" value pairs.".
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	HTTPHeaders map[string]*string `json:"httpHeaders,omitempty" tf:"http_headers,omitempty"`
 
 	// MIME type used to serve all files served by this handler.
diff --git a/apis/artifact/v1beta1/zz_generated_terraformed.go b/apis/artifact/v1beta1/zz_generated_terraformed.go
index 9ce80c762..2bbe581fb 100755
--- a/apis/artifact/v1beta1/zz_generated_terraformed.go
+++ b/apis/artifact/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *RegistryRepository) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this RegistryRepository
+func (tr *RegistryRepository) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this RegistryRepository using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *RegistryRepository) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *RegistryRepositoryIAMMember) GetInitParameters() (map[string]any, erro
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this RegistryRepositoryIAMMember
+func (tr *RegistryRepositoryIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this RegistryRepositoryIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *RegistryRepositoryIAMMember) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/artifact/v1beta1/zz_registryrepository_types.go b/apis/artifact/v1beta1/zz_registryrepository_types.go
index bb21b4909..662a5b3cb 100755
--- a/apis/artifact/v1beta1/zz_registryrepository_types.go
+++ b/apis/artifact/v1beta1/zz_registryrepository_types.go
@@ -212,6 +212,7 @@ type RegistryRepositoryInitParameters struct {
 	// longer than 63 characters. Label keys must begin with a lowercase letter
 	// and may only contain lowercase letters, numeric characters, underscores,
 	// and dashes.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// MavenRepositoryConfig is maven related repository details.
@@ -270,6 +271,7 @@ type RegistryRepositoryObservation struct {
 	// longer than 63 characters. Label keys must begin with a lowercase letter
 	// and may only contain lowercase letters, numeric characters, underscores,
 	// and dashes.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The name of the location this repository is located in.
@@ -337,6 +339,7 @@ type RegistryRepositoryParameters struct {
 	// and may only contain lowercase letters, numeric characters, underscores,
 	// and dashes.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The name of the location this repository is located in.
diff --git a/apis/beyondcorp/v1beta1/zz_appconnection_types.go b/apis/beyondcorp/v1beta1/zz_appconnection_types.go
index e4dae0102..9af2a8ca3 100755
--- a/apis/beyondcorp/v1beta1/zz_appconnection_types.go
+++ b/apis/beyondcorp/v1beta1/zz_appconnection_types.go
@@ -46,6 +46,7 @@ type AppConnectionInitParameters struct {
 	Gateway []GatewayInitParameters `json:"gateway,omitempty" tf:"gateway,omitempty"`
 
 	// Resource labels to represent user provided metadata.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// ID of the AppConnection.
@@ -84,6 +85,7 @@ type AppConnectionObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// Resource labels to represent user provided metadata.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// ID of the AppConnection.
@@ -124,6 +126,7 @@ type AppConnectionParameters struct {
 
 	// Resource labels to represent user provided metadata.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// ID of the AppConnection.
diff --git a/apis/beyondcorp/v1beta1/zz_appconnector_types.go b/apis/beyondcorp/v1beta1/zz_appconnector_types.go
index 7f0e8f1d3..a40f95ad5 100755
--- a/apis/beyondcorp/v1beta1/zz_appconnector_types.go
+++ b/apis/beyondcorp/v1beta1/zz_appconnector_types.go
@@ -35,6 +35,7 @@ type AppConnectorInitParameters struct {
 	DisplayName *string `json:"displayName,omitempty" tf:"display_name,omitempty"`
 
 	// Resource labels to represent user provided metadata.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Principal information about the Identity of the AppConnector.
@@ -55,6 +56,7 @@ type AppConnectorObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// Resource labels to represent user provided metadata.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Principal information about the Identity of the AppConnector.
@@ -80,6 +82,7 @@ type AppConnectorParameters struct {
 
 	// Resource labels to represent user provided metadata.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Principal information about the Identity of the AppConnector.
diff --git a/apis/beyondcorp/v1beta1/zz_appgateway_types.go b/apis/beyondcorp/v1beta1/zz_appgateway_types.go
index d14ae574d..fa02664d4 100755
--- a/apis/beyondcorp/v1beta1/zz_appgateway_types.go
+++ b/apis/beyondcorp/v1beta1/zz_appgateway_types.go
@@ -55,6 +55,7 @@ type AppGatewayInitParameters struct {
 	HostType *string `json:"hostType,omitempty" tf:"host_type,omitempty"`
 
 	// Resource labels to represent user provided metadata.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -85,6 +86,7 @@ type AppGatewayObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// Resource labels to represent user provided metadata.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -120,6 +122,7 @@ type AppGatewayParameters struct {
 
 	// Resource labels to represent user provided metadata.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
diff --git a/apis/beyondcorp/v1beta1/zz_generated_terraformed.go b/apis/beyondcorp/v1beta1/zz_generated_terraformed.go
index 0586a09ae..d097a48ca 100755
--- a/apis/beyondcorp/v1beta1/zz_generated_terraformed.go
+++ b/apis/beyondcorp/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *AppConnection) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this AppConnection
+func (tr *AppConnection) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this AppConnection using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *AppConnection) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *AppConnector) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this AppConnector
+func (tr *AppConnector) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this AppConnector using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *AppConnector) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *AppGateway) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this AppGateway
+func (tr *AppGateway) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this AppGateway using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *AppGateway) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/bigquery/v1beta1/zz_dataset_types.go b/apis/bigquery/v1beta1/zz_dataset_types.go
index 036521a79..8cb81f445 100755
--- a/apis/bigquery/v1beta1/zz_dataset_types.go
+++ b/apis/bigquery/v1beta1/zz_dataset_types.go
@@ -292,6 +292,7 @@ type DatasetInitParameters struct {
 
 	// The labels associated with this dataset. You can use these to
 	// organize and group your datasets
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The geographic location where the dataset should reside.
@@ -365,6 +366,7 @@ type DatasetObservation struct {
 
 	// The labels associated with this dataset. You can use these to
 	// organize and group your datasets
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The date when this dataset or any of its tables was last modified, in
@@ -449,6 +451,7 @@ type DatasetParameters struct {
 	// The labels associated with this dataset. You can use these to
 	// organize and group your datasets
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The geographic location where the dataset should reside.
diff --git a/apis/bigquery/v1beta1/zz_datasetiambinding_types.go b/apis/bigquery/v1beta1/zz_datasetiambinding_types.go
index e5d890094..92d42864d 100755
--- a/apis/bigquery/v1beta1/zz_datasetiambinding_types.go
+++ b/apis/bigquery/v1beta1/zz_datasetiambinding_types.go
@@ -60,6 +60,7 @@ type DatasetIAMBindingConditionParameters struct {
 type DatasetIAMBindingInitParameters struct {
 	Condition []DatasetIAMBindingConditionInitParameters `json:"condition,omitempty" tf:"condition,omitempty"`
 
+	// +listType=set
 	Members []*string `json:"members,omitempty" tf:"members,omitempty"`
 
 	Project *string `json:"project,omitempty" tf:"project,omitempty"`
@@ -74,6 +75,7 @@ type DatasetIAMBindingObservation struct {
 
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
+	// +listType=set
 	Members []*string `json:"members,omitempty" tf:"members,omitempty"`
 
 	Project *string `json:"project,omitempty" tf:"project,omitempty"`
@@ -99,6 +101,7 @@ type DatasetIAMBindingParameters struct {
 	DatasetIDSelector *v1.Selector `json:"datasetIdSelector,omitempty" tf:"-"`
 
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Members []*string `json:"members,omitempty" tf:"members,omitempty"`
 
 	// +kubebuilder:validation:Optional
diff --git a/apis/bigquery/v1beta1/zz_datatransferconfig_types.go b/apis/bigquery/v1beta1/zz_datatransferconfig_types.go
index 1a5ac682e..4d5d7d860 100755
--- a/apis/bigquery/v1beta1/zz_datatransferconfig_types.go
+++ b/apis/bigquery/v1beta1/zz_datatransferconfig_types.go
@@ -64,6 +64,7 @@ type DataTransferConfigInitParameters struct {
 	// section for each data source. For example the parameters for Cloud Storage transfers are listed here:
 	// https://cloud.google.com/bigquery-transfer/docs/cloud-storage-transfer#bq
 	// NOTE : If you are attempting to update a parameter that cannot be updated (due to api limitations) please force recreation of the resource.
+	// +mapType=granular
 	Params map[string]*string `json:"params,omitempty" tf:"params,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -146,6 +147,7 @@ type DataTransferConfigObservation struct {
 	// section for each data source. For example the parameters for Cloud Storage transfers are listed here:
 	// https://cloud.google.com/bigquery-transfer/docs/cloud-storage-transfer#bq
 	// NOTE : If you are attempting to update a parameter that cannot be updated (due to api limitations) please force recreation of the resource.
+	// +mapType=granular
 	Params map[string]*string `json:"params,omitempty" tf:"params,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -237,6 +239,7 @@ type DataTransferConfigParameters struct {
 	// https://cloud.google.com/bigquery-transfer/docs/cloud-storage-transfer#bq
 	// NOTE : If you are attempting to update a parameter that cannot be updated (due to api limitations) please force recreation of the resource.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Params map[string]*string `json:"params,omitempty" tf:"params,omitempty"`
 
 	// The ID of the project in which the resource belongs.
diff --git a/apis/bigquery/v1beta1/zz_generated_terraformed.go b/apis/bigquery/v1beta1/zz_generated_terraformed.go
index 36ab81dbf..dcc8d865a 100755
--- a/apis/bigquery/v1beta1/zz_generated_terraformed.go
+++ b/apis/bigquery/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *AnalyticsHubDataExchange) GetInitParameters() (map[string]any, error)
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this AnalyticsHubDataExchange
+func (tr *AnalyticsHubDataExchange) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this AnalyticsHubDataExchange using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *AnalyticsHubDataExchange) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *AnalyticsHubDataExchangeIAMMember) GetInitParameters() (map[string]any
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this AnalyticsHubDataExchangeIAMMember
+func (tr *AnalyticsHubDataExchangeIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this AnalyticsHubDataExchangeIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *AnalyticsHubDataExchangeIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *AnalyticsHubListing) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this AnalyticsHubListing
+func (tr *AnalyticsHubListing) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this AnalyticsHubListing using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *AnalyticsHubListing) LateInitialize(attrs []byte) (bool, error) {
@@ -347,6 +438,36 @@ func (tr *Connection) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Connection
+func (tr *Connection) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Connection using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Connection) LateInitialize(attrs []byte) (bool, error) {
@@ -431,6 +552,36 @@ func (tr *DataTransferConfig) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this DataTransferConfig
+func (tr *DataTransferConfig) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this DataTransferConfig using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *DataTransferConfig) LateInitialize(attrs []byte) (bool, error) {
@@ -515,6 +666,36 @@ func (tr *Dataset) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Dataset
+func (tr *Dataset) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Dataset using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Dataset) LateInitialize(attrs []byte) (bool, error) {
@@ -599,6 +780,36 @@ func (tr *DatasetAccess) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this DatasetAccess
+func (tr *DatasetAccess) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this DatasetAccess using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *DatasetAccess) LateInitialize(attrs []byte) (bool, error) {
@@ -683,6 +894,36 @@ func (tr *DatasetIAMBinding) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this DatasetIAMBinding
+func (tr *DatasetIAMBinding) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this DatasetIAMBinding using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *DatasetIAMBinding) LateInitialize(attrs []byte) (bool, error) {
@@ -767,6 +1008,36 @@ func (tr *DatasetIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this DatasetIAMMember
+func (tr *DatasetIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this DatasetIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *DatasetIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -851,6 +1122,36 @@ func (tr *DatasetIAMPolicy) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this DatasetIAMPolicy
+func (tr *DatasetIAMPolicy) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this DatasetIAMPolicy using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *DatasetIAMPolicy) LateInitialize(attrs []byte) (bool, error) {
@@ -935,6 +1236,36 @@ func (tr *Job) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Job
+func (tr *Job) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Job using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Job) LateInitialize(attrs []byte) (bool, error) {
@@ -1019,6 +1350,36 @@ func (tr *Reservation) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Reservation
+func (tr *Reservation) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Reservation using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Reservation) LateInitialize(attrs []byte) (bool, error) {
@@ -1103,6 +1464,36 @@ func (tr *ReservationAssignment) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ReservationAssignment
+func (tr *ReservationAssignment) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ReservationAssignment using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ReservationAssignment) LateInitialize(attrs []byte) (bool, error) {
@@ -1187,6 +1578,36 @@ func (tr *Routine) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Routine
+func (tr *Routine) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Routine using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Routine) LateInitialize(attrs []byte) (bool, error) {
@@ -1271,6 +1692,36 @@ func (tr *Table) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Table
+func (tr *Table) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Table using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Table) LateInitialize(attrs []byte) (bool, error) {
@@ -1355,6 +1806,36 @@ func (tr *TableIAMBinding) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this TableIAMBinding
+func (tr *TableIAMBinding) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this TableIAMBinding using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *TableIAMBinding) LateInitialize(attrs []byte) (bool, error) {
@@ -1439,6 +1920,36 @@ func (tr *TableIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this TableIAMMember
+func (tr *TableIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this TableIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *TableIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -1523,6 +2034,36 @@ func (tr *TableIAMPolicy) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this TableIAMPolicy
+func (tr *TableIAMPolicy) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this TableIAMPolicy using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *TableIAMPolicy) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/bigquery/v1beta1/zz_job_types.go b/apis/bigquery/v1beta1/zz_job_types.go
index de05870e1..53f24b2c0 100755
--- a/apis/bigquery/v1beta1/zz_job_types.go
+++ b/apis/bigquery/v1beta1/zz_job_types.go
@@ -415,6 +415,7 @@ type JobInitParameters struct {
 	JobTimeoutMs *string `json:"jobTimeoutMs,omitempty" tf:"job_timeout_ms,omitempty"`
 
 	// The labels associated with this job. You can use these to organize and group your jobs.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Configures a load job.
@@ -457,6 +458,7 @@ type JobObservation struct {
 	JobType *string `json:"jobType,omitempty" tf:"job_type,omitempty"`
 
 	// The labels associated with this job. You can use these to organize and group your jobs.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Configures a load job.
@@ -504,6 +506,7 @@ type JobParameters struct {
 
 	// The labels associated with this job. You can use these to organize and group your jobs.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Configures a load job.
diff --git a/apis/bigquery/v1beta1/zz_table_types.go b/apis/bigquery/v1beta1/zz_table_types.go
index a63802b20..395857246 100755
--- a/apis/bigquery/v1beta1/zz_table_types.go
+++ b/apis/bigquery/v1beta1/zz_table_types.go
@@ -769,6 +769,7 @@ type TableInitParameters struct {
 	FriendlyName *string `json:"friendlyName,omitempty" tf:"friendly_name,omitempty"`
 
 	// A mapping of labels to assign to the resource.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// If specified, configures this table as a materialized view.
@@ -837,6 +838,7 @@ type TableObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// A mapping of labels to assign to the resource.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The time when this table was last modified, in milliseconds since the epoch.
@@ -939,6 +941,7 @@ type TableParameters struct {
 
 	// A mapping of labels to assign to the resource.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// If specified, configures this table as a materialized view.
diff --git a/apis/bigquery/v1beta1/zz_tableiambinding_types.go b/apis/bigquery/v1beta1/zz_tableiambinding_types.go
index 652ecb4fc..24dd7d726 100755
--- a/apis/bigquery/v1beta1/zz_tableiambinding_types.go
+++ b/apis/bigquery/v1beta1/zz_tableiambinding_types.go
@@ -60,6 +60,7 @@ type TableIAMBindingConditionParameters struct {
 type TableIAMBindingInitParameters struct {
 	Condition []TableIAMBindingConditionInitParameters `json:"condition,omitempty" tf:"condition,omitempty"`
 
+	// +listType=set
 	Members []*string `json:"members,omitempty" tf:"members,omitempty"`
 
 	Project *string `json:"project,omitempty" tf:"project,omitempty"`
@@ -76,6 +77,7 @@ type TableIAMBindingObservation struct {
 
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
+	// +listType=set
 	Members []*string `json:"members,omitempty" tf:"members,omitempty"`
 
 	Project *string `json:"project,omitempty" tf:"project,omitempty"`
@@ -103,6 +105,7 @@ type TableIAMBindingParameters struct {
 	DatasetIDSelector *v1.Selector `json:"datasetIdSelector,omitempty" tf:"-"`
 
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Members []*string `json:"members,omitempty" tf:"members,omitempty"`
 
 	// +kubebuilder:validation:Optional
diff --git a/apis/bigtable/v1beta1/zz_generated_terraformed.go b/apis/bigtable/v1beta1/zz_generated_terraformed.go
index 4fcea6a66..7d8bc64aa 100755
--- a/apis/bigtable/v1beta1/zz_generated_terraformed.go
+++ b/apis/bigtable/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *AppProfile) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this AppProfile
+func (tr *AppProfile) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this AppProfile using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *AppProfile) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *GarbageCollectionPolicy) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this GarbageCollectionPolicy
+func (tr *GarbageCollectionPolicy) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this GarbageCollectionPolicy using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *GarbageCollectionPolicy) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *Instance) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Instance
+func (tr *Instance) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Instance using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Instance) LateInitialize(attrs []byte) (bool, error) {
@@ -347,6 +438,36 @@ func (tr *InstanceIAMBinding) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this InstanceIAMBinding
+func (tr *InstanceIAMBinding) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this InstanceIAMBinding using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *InstanceIAMBinding) LateInitialize(attrs []byte) (bool, error) {
@@ -431,6 +552,36 @@ func (tr *InstanceIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this InstanceIAMMember
+func (tr *InstanceIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this InstanceIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *InstanceIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -515,6 +666,36 @@ func (tr *InstanceIAMPolicy) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this InstanceIAMPolicy
+func (tr *InstanceIAMPolicy) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this InstanceIAMPolicy using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *InstanceIAMPolicy) LateInitialize(attrs []byte) (bool, error) {
@@ -599,6 +780,36 @@ func (tr *Table) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Table
+func (tr *Table) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Table using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Table) LateInitialize(attrs []byte) (bool, error) {
@@ -683,6 +894,36 @@ func (tr *TableIAMBinding) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this TableIAMBinding
+func (tr *TableIAMBinding) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this TableIAMBinding using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *TableIAMBinding) LateInitialize(attrs []byte) (bool, error) {
@@ -767,6 +1008,36 @@ func (tr *TableIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this TableIAMMember
+func (tr *TableIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this TableIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *TableIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -851,6 +1122,36 @@ func (tr *TableIAMPolicy) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this TableIAMPolicy
+func (tr *TableIAMPolicy) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this TableIAMPolicy using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *TableIAMPolicy) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/bigtable/v1beta1/zz_instance_types.go b/apis/bigtable/v1beta1/zz_instance_types.go
index 70101a86a..4cbc02025 100755
--- a/apis/bigtable/v1beta1/zz_instance_types.go
+++ b/apis/bigtable/v1beta1/zz_instance_types.go
@@ -179,6 +179,7 @@ type InstanceInitParameters struct {
 	InstanceType *string `json:"instanceType,omitempty" tf:"instance_type,omitempty"`
 
 	// A set of key/value label pairs to assign to the resource. Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs. If it
@@ -209,6 +210,7 @@ type InstanceObservation struct {
 	InstanceType *string `json:"instanceType,omitempty" tf:"instance_type,omitempty"`
 
 	// A set of key/value label pairs to assign to the resource. Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs. If it
@@ -241,6 +243,7 @@ type InstanceParameters struct {
 
 	// A set of key/value label pairs to assign to the resource. Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs. If it
diff --git a/apis/bigtable/v1beta1/zz_instanceiambinding_types.go b/apis/bigtable/v1beta1/zz_instanceiambinding_types.go
index 2f2a1fe0c..8c47fe833 100755
--- a/apis/bigtable/v1beta1/zz_instanceiambinding_types.go
+++ b/apis/bigtable/v1beta1/zz_instanceiambinding_types.go
@@ -60,6 +60,7 @@ type ConditionParameters struct {
 type InstanceIAMBindingInitParameters struct {
 	Condition []ConditionInitParameters `json:"condition,omitempty" tf:"condition,omitempty"`
 
+	// +listType=set
 	Members []*string `json:"members,omitempty" tf:"members,omitempty"`
 
 	Project *string `json:"project,omitempty" tf:"project,omitempty"`
@@ -74,6 +75,7 @@ type InstanceIAMBindingObservation struct {
 
 	Instance *string `json:"instance,omitempty" tf:"instance,omitempty"`
 
+	// +listType=set
 	Members []*string `json:"members,omitempty" tf:"members,omitempty"`
 
 	Project *string `json:"project,omitempty" tf:"project,omitempty"`
@@ -90,6 +92,7 @@ type InstanceIAMBindingParameters struct {
 	Instance *string `json:"instance" tf:"instance,omitempty"`
 
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Members []*string `json:"members,omitempty" tf:"members,omitempty"`
 
 	// +kubebuilder:validation:Optional
diff --git a/apis/bigtable/v1beta1/zz_tableiambinding_types.go b/apis/bigtable/v1beta1/zz_tableiambinding_types.go
index 8fe588f66..2e19ceff4 100755
--- a/apis/bigtable/v1beta1/zz_tableiambinding_types.go
+++ b/apis/bigtable/v1beta1/zz_tableiambinding_types.go
@@ -62,6 +62,7 @@ type TableIAMBindingInitParameters struct {
 
 	Instance *string `json:"instance,omitempty" tf:"instance,omitempty"`
 
+	// +listType=set
 	Members []*string `json:"members,omitempty" tf:"members,omitempty"`
 
 	Project *string `json:"project,omitempty" tf:"project,omitempty"`
@@ -76,6 +77,7 @@ type TableIAMBindingObservation struct {
 
 	Instance *string `json:"instance,omitempty" tf:"instance,omitempty"`
 
+	// +listType=set
 	Members []*string `json:"members,omitempty" tf:"members,omitempty"`
 
 	Project *string `json:"project,omitempty" tf:"project,omitempty"`
@@ -94,6 +96,7 @@ type TableIAMBindingParameters struct {
 	Instance *string `json:"instance,omitempty" tf:"instance,omitempty"`
 
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Members []*string `json:"members,omitempty" tf:"members,omitempty"`
 
 	// +kubebuilder:validation:Optional
diff --git a/apis/binaryauthorization/v1beta1/zz_generated_terraformed.go b/apis/binaryauthorization/v1beta1/zz_generated_terraformed.go
index 742fa15bb..224487966 100755
--- a/apis/binaryauthorization/v1beta1/zz_generated_terraformed.go
+++ b/apis/binaryauthorization/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Attestor) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Attestor
+func (tr *Attestor) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Attestor using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Attestor) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *Policy) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Policy
+func (tr *Policy) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Policy using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Policy) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/binaryauthorization/v1beta1/zz_policy_types.go b/apis/binaryauthorization/v1beta1/zz_policy_types.go
index 08065709f..d284ffe40 100755
--- a/apis/binaryauthorization/v1beta1/zz_policy_types.go
+++ b/apis/binaryauthorization/v1beta1/zz_policy_types.go
@@ -78,6 +78,7 @@ type ClusterAdmissionRulesInitParameters struct {
 	// request must be able to read the attestor resource.
 	// Note: this field must be non-empty when the evaluation_mode field
 	// specifies REQUIRE_ATTESTATION, otherwise it must be empty.
+	// +listType=set
 	RequireAttestationsBy []*string `json:"requireAttestationsBy,omitempty" tf:"require_attestations_by,omitempty"`
 }
 
@@ -102,6 +103,7 @@ type ClusterAdmissionRulesObservation struct {
 	// request must be able to read the attestor resource.
 	// Note: this field must be non-empty when the evaluation_mode field
 	// specifies REQUIRE_ATTESTATION, otherwise it must be empty.
+	// +listType=set
 	RequireAttestationsBy []*string `json:"requireAttestationsBy,omitempty" tf:"require_attestations_by,omitempty"`
 }
 
@@ -130,6 +132,7 @@ type ClusterAdmissionRulesParameters struct {
 	// Note: this field must be non-empty when the evaluation_mode field
 	// specifies REQUIRE_ATTESTATION, otherwise it must be empty.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	RequireAttestationsBy []*string `json:"requireAttestationsBy,omitempty" tf:"require_attestations_by,omitempty"`
 }
 
@@ -151,6 +154,7 @@ type DefaultAdmissionRuleInitParameters struct {
 	// request must be able to read the attestor resource.
 	// Note: this field must be non-empty when the evaluation_mode field
 	// specifies REQUIRE_ATTESTATION, otherwise it must be empty.
+	// +listType=set
 	RequireAttestationsBy []*string `json:"requireAttestationsBy,omitempty" tf:"require_attestations_by,omitempty"`
 }
 
@@ -172,6 +176,7 @@ type DefaultAdmissionRuleObservation struct {
 	// request must be able to read the attestor resource.
 	// Note: this field must be non-empty when the evaluation_mode field
 	// specifies REQUIRE_ATTESTATION, otherwise it must be empty.
+	// +listType=set
 	RequireAttestationsBy []*string `json:"requireAttestationsBy,omitempty" tf:"require_attestations_by,omitempty"`
 }
 
@@ -196,6 +201,7 @@ type DefaultAdmissionRuleParameters struct {
 	// Note: this field must be non-empty when the evaluation_mode field
 	// specifies REQUIRE_ATTESTATION, otherwise it must be empty.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	RequireAttestationsBy []*string `json:"requireAttestationsBy,omitempty" tf:"require_attestations_by,omitempty"`
 }
 
diff --git a/apis/certificatemanager/v1beta1/zz_certificate_types.go b/apis/certificatemanager/v1beta1/zz_certificate_types.go
index 01b9fe8d2..c29d28772 100755
--- a/apis/certificatemanager/v1beta1/zz_certificate_types.go
+++ b/apis/certificatemanager/v1beta1/zz_certificate_types.go
@@ -62,6 +62,7 @@ type CertificateInitParameters struct {
 	Description *string `json:"description,omitempty" tf:"description,omitempty"`
 
 	// Set of label tags associated with the Certificate resource.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Configuration and state of a Managed Certificate.
@@ -98,6 +99,7 @@ type CertificateObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// Set of label tags associated with the Certificate resource.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The Certificate Manager location. If not specified, "global" is used.
@@ -136,6 +138,7 @@ type CertificateParameters struct {
 
 	// Set of label tags associated with the Certificate resource.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The Certificate Manager location. If not specified, "global" is used.
diff --git a/apis/certificatemanager/v1beta1/zz_certificatemap_types.go b/apis/certificatemanager/v1beta1/zz_certificatemap_types.go
index 058e1ed7c..c24415440 100755
--- a/apis/certificatemanager/v1beta1/zz_certificatemap_types.go
+++ b/apis/certificatemanager/v1beta1/zz_certificatemap_types.go
@@ -35,6 +35,7 @@ type CertificateMapInitParameters struct {
 	Description *string `json:"description,omitempty" tf:"description,omitempty"`
 
 	// Set of labels associated with a Certificate Map resource.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -60,6 +61,7 @@ type CertificateMapObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// Set of labels associated with a Certificate Map resource.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -80,6 +82,7 @@ type CertificateMapParameters struct {
 
 	// Set of labels associated with a Certificate Map resource.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
diff --git a/apis/certificatemanager/v1beta1/zz_certificatemapentry_types.go b/apis/certificatemanager/v1beta1/zz_certificatemapentry_types.go
index bee98351b..6c012b0e6 100755
--- a/apis/certificatemanager/v1beta1/zz_certificatemapentry_types.go
+++ b/apis/certificatemanager/v1beta1/zz_certificatemapentry_types.go
@@ -47,6 +47,7 @@ type CertificateMapEntryInitParameters struct {
 	// Set of labels associated with a Certificate Map Entry.
 	// An object containing a list of "key": value pairs.
 	// Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// A predefined matcher for particular cases, other than SNI selection
@@ -83,6 +84,7 @@ type CertificateMapEntryObservation struct {
 	// Set of labels associated with a Certificate Map Entry.
 	// An object containing a list of "key": value pairs.
 	// Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// A map entry that is inputted into the cetrificate map
@@ -126,6 +128,7 @@ type CertificateMapEntryParameters struct {
 	// An object containing a list of "key": value pairs.
 	// Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// A map entry that is inputted into the cetrificate map
diff --git a/apis/certificatemanager/v1beta1/zz_dnsauthorization_types.go b/apis/certificatemanager/v1beta1/zz_dnsauthorization_types.go
index 9c83a9abd..0a46e136e 100755
--- a/apis/certificatemanager/v1beta1/zz_dnsauthorization_types.go
+++ b/apis/certificatemanager/v1beta1/zz_dnsauthorization_types.go
@@ -40,6 +40,7 @@ type DNSAuthorizationInitParameters struct {
 	Domain *string `json:"domain,omitempty" tf:"domain,omitempty"`
 
 	// Set of label tags associated with the DNS Authorization resource.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -67,6 +68,7 @@ type DNSAuthorizationObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// Set of label tags associated with the DNS Authorization resource.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -88,6 +90,7 @@ type DNSAuthorizationParameters struct {
 
 	// Set of label tags associated with the DNS Authorization resource.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
diff --git a/apis/certificatemanager/v1beta1/zz_generated_terraformed.go b/apis/certificatemanager/v1beta1/zz_generated_terraformed.go
index fe6192a38..4280db3e4 100755
--- a/apis/certificatemanager/v1beta1/zz_generated_terraformed.go
+++ b/apis/certificatemanager/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Certificate) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Certificate
+func (tr *Certificate) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Certificate using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Certificate) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *CertificateMap) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this CertificateMap
+func (tr *CertificateMap) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this CertificateMap using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *CertificateMap) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *CertificateMapEntry) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this CertificateMapEntry
+func (tr *CertificateMapEntry) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this CertificateMapEntry using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *CertificateMapEntry) LateInitialize(attrs []byte) (bool, error) {
@@ -347,6 +438,36 @@ func (tr *DNSAuthorization) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this DNSAuthorization
+func (tr *DNSAuthorization) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this DNSAuthorization using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *DNSAuthorization) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/cloud/v1beta1/zz_generated_terraformed.go b/apis/cloud/v1beta1/zz_generated_terraformed.go
index 6ca77b515..ef2e5770c 100755
--- a/apis/cloud/v1beta1/zz_generated_terraformed.go
+++ b/apis/cloud/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *IdsEndpoint) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this IdsEndpoint
+func (tr *IdsEndpoint) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this IdsEndpoint using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *IdsEndpoint) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/cloudbuild/v1beta1/zz_generated_terraformed.go b/apis/cloudbuild/v1beta1/zz_generated_terraformed.go
index a7dba8562..cb89a94e7 100755
--- a/apis/cloudbuild/v1beta1/zz_generated_terraformed.go
+++ b/apis/cloudbuild/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Trigger) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Trigger
+func (tr *Trigger) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Trigger using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Trigger) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *WorkerPool) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this WorkerPool
+func (tr *WorkerPool) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this WorkerPool using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *WorkerPool) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/cloudbuild/v1beta1/zz_trigger_types.go b/apis/cloudbuild/v1beta1/zz_trigger_types.go
index 11109468d..2135adbbc 100755
--- a/apis/cloudbuild/v1beta1/zz_trigger_types.go
+++ b/apis/cloudbuild/v1beta1/zz_trigger_types.go
@@ -238,6 +238,7 @@ type BuildInitParameters struct {
 	Step []StepInitParameters `json:"step,omitempty" tf:"step,omitempty"`
 
 	// Substitutions data for Build resource.
+	// +mapType=granular
 	Substitutions map[string]*string `json:"substitutions,omitempty" tf:"substitutions,omitempty"`
 
 	// Tags for annotation of a Build. These are not docker tags.
@@ -295,6 +296,7 @@ type BuildObservation struct {
 	Step []StepObservation `json:"step,omitempty" tf:"step,omitempty"`
 
 	// Substitutions data for Build resource.
+	// +mapType=granular
 	Substitutions map[string]*string `json:"substitutions,omitempty" tf:"substitutions,omitempty"`
 
 	// Tags for annotation of a Build. These are not docker tags.
@@ -362,6 +364,7 @@ type BuildParameters struct {
 
 	// Substitutions data for Build resource.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Substitutions map[string]*string `json:"substitutions,omitempty" tf:"substitutions,omitempty"`
 
 	// Tags for annotation of a Build. These are not docker tags.
@@ -1053,6 +1056,7 @@ type RepoSourceInitParameters struct {
 	RepoName *string `json:"repoName,omitempty" tf:"repo_name,omitempty"`
 
 	// Substitutions data for Build resource.
+	// +mapType=granular
 	Substitutions map[string]*string `json:"substitutions,omitempty" tf:"substitutions,omitempty"`
 
 	// Name of the tag to build. Exactly one of a branch name, tag, or commit SHA must be provided.
@@ -1086,6 +1090,7 @@ type RepoSourceObservation struct {
 	RepoName *string `json:"repoName,omitempty" tf:"repo_name,omitempty"`
 
 	// Substitutions data for Build resource.
+	// +mapType=granular
 	Substitutions map[string]*string `json:"substitutions,omitempty" tf:"substitutions,omitempty"`
 
 	// Name of the tag to build. Exactly one of a branch name, tag, or commit SHA must be provided.
@@ -1126,6 +1131,7 @@ type RepoSourceParameters struct {
 
 	// Substitutions data for Build resource.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Substitutions map[string]*string `json:"substitutions,omitempty" tf:"substitutions,omitempty"`
 
 	// Name of the tag to build. Exactly one of a branch name, tag, or commit SHA must be provided.
@@ -1287,6 +1293,7 @@ type SecretInitParameters struct {
 	// a Cloud Key
 	// Management Service crypto key. These values must be specified in
 	// the build's Secret.
+	// +mapType=granular
 	SecretEnv map[string]*string `json:"secretEnv,omitempty" tf:"secret_env,omitempty"`
 }
 
@@ -1337,6 +1344,7 @@ type SecretObservation struct {
 	// a Cloud Key
 	// Management Service crypto key. These values must be specified in
 	// the build's Secret.
+	// +mapType=granular
 	SecretEnv map[string]*string `json:"secretEnv,omitempty" tf:"secret_env,omitempty"`
 }
 
@@ -1351,6 +1359,7 @@ type SecretParameters struct {
 	// Management Service crypto key. These values must be specified in
 	// the build's Secret.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	SecretEnv map[string]*string `json:"secretEnv,omitempty" tf:"secret_env,omitempty"`
 }
 
@@ -1926,6 +1935,7 @@ type TriggerInitParameters struct {
 	SourceToBuild []SourceToBuildInitParameters `json:"sourceToBuild,omitempty" tf:"source_to_build,omitempty"`
 
 	// Substitutions data for Build resource.
+	// +mapType=granular
 	Substitutions map[string]*string `json:"substitutions,omitempty" tf:"substitutions,omitempty"`
 
 	// Tags for annotation of a BuildTrigger
@@ -2054,6 +2064,7 @@ type TriggerObservation struct {
 	SourceToBuild []SourceToBuildObservation `json:"sourceToBuild,omitempty" tf:"source_to_build,omitempty"`
 
 	// Substitutions data for Build resource.
+	// +mapType=granular
 	Substitutions map[string]*string `json:"substitutions,omitempty" tf:"substitutions,omitempty"`
 
 	// Tags for annotation of a BuildTrigger
@@ -2209,6 +2220,7 @@ type TriggerParameters struct {
 
 	// Substitutions data for Build resource.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Substitutions map[string]*string `json:"substitutions,omitempty" tf:"substitutions,omitempty"`
 
 	// Tags for annotation of a BuildTrigger
diff --git a/apis/cloudbuild/v1beta1/zz_workerpool_types.go b/apis/cloudbuild/v1beta1/zz_workerpool_types.go
index 0cb253723..9bf3eae1d 100755
--- a/apis/cloudbuild/v1beta1/zz_workerpool_types.go
+++ b/apis/cloudbuild/v1beta1/zz_workerpool_types.go
@@ -105,6 +105,8 @@ type WorkerConfigParameters struct {
 }
 
 type WorkerPoolInitParameters struct {
+
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// User-defined name of the WorkerPool.
@@ -121,6 +123,8 @@ type WorkerPoolInitParameters struct {
 }
 
 type WorkerPoolObservation struct {
+
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Output only. Time at which the request to create the WorkerPool was received.
@@ -160,6 +164,7 @@ type WorkerPoolObservation struct {
 type WorkerPoolParameters struct {
 
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// User-defined name of the WorkerPool.
diff --git a/apis/cloudfunctions/v1beta1/zz_generated_terraformed.go b/apis/cloudfunctions/v1beta1/zz_generated_terraformed.go
index 8960cc8ba..d612b39ff 100755
--- a/apis/cloudfunctions/v1beta1/zz_generated_terraformed.go
+++ b/apis/cloudfunctions/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Function) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Function
+func (tr *Function) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Function using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Function) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *FunctionIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this FunctionIAMMember
+func (tr *FunctionIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this FunctionIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *FunctionIAMMember) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/cloudfunctions2/v1beta1/zz_function_types.go b/apis/cloudfunctions2/v1beta1/zz_function_types.go
index 84d2ed7b4..d3b3888d0 100755
--- a/apis/cloudfunctions2/v1beta1/zz_function_types.go
+++ b/apis/cloudfunctions2/v1beta1/zz_function_types.go
@@ -42,6 +42,7 @@ type BuildConfigInitParameters struct {
 	EntryPoint *string `json:"entryPoint,omitempty" tf:"entry_point,omitempty"`
 
 	// User-provided build-time environment variables for the function.
+	// +mapType=granular
 	EnvironmentVariables map[string]*string `json:"environmentVariables,omitempty" tf:"environment_variables,omitempty"`
 
 	// The runtime in which to run the function. Required when deploying a new
@@ -71,6 +72,7 @@ type BuildConfigObservation struct {
 	EntryPoint *string `json:"entryPoint,omitempty" tf:"entry_point,omitempty"`
 
 	// User-provided build-time environment variables for the function.
+	// +mapType=granular
 	EnvironmentVariables map[string]*string `json:"environmentVariables,omitempty" tf:"environment_variables,omitempty"`
 
 	// The runtime in which to run the function. Required when deploying a new
@@ -101,6 +103,7 @@ type BuildConfigParameters struct {
 
 	// User-provided build-time environment variables for the function.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	EnvironmentVariables map[string]*string `json:"environmentVariables,omitempty" tf:"environment_variables,omitempty"`
 
 	// The runtime in which to run the function. Required when deploying a new
@@ -316,6 +319,7 @@ type FunctionInitParameters struct {
 	EventTrigger []EventTriggerInitParameters `json:"eventTrigger,omitempty" tf:"event_trigger,omitempty"`
 
 	// A set of key/value label pairs associated with this Cloud Function.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -349,6 +353,7 @@ type FunctionObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// A set of key/value label pairs associated with this Cloud Function.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The location of this cloud function.
@@ -392,6 +397,7 @@ type FunctionParameters struct {
 
 	// A set of key/value label pairs associated with this Cloud Function.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The location of this cloud function.
@@ -618,6 +624,7 @@ type ServiceConfigInitParameters struct {
 	AvailableMemory *string `json:"availableMemory,omitempty" tf:"available_memory,omitempty"`
 
 	// Environment variables that shall be available during function execution.
+	// +mapType=granular
 	EnvironmentVariables map[string]*string `json:"environmentVariables,omitempty" tf:"environment_variables,omitempty"`
 
 	// Available ingress settings. Defaults to "ALLOW_ALL" if unspecified.
@@ -674,6 +681,7 @@ type ServiceConfigObservation struct {
 	AvailableMemory *string `json:"availableMemory,omitempty" tf:"available_memory,omitempty"`
 
 	// Environment variables that shall be available during function execution.
+	// +mapType=granular
 	EnvironmentVariables map[string]*string `json:"environmentVariables,omitempty" tf:"environment_variables,omitempty"`
 
 	// (Output)
@@ -745,6 +753,7 @@ type ServiceConfigParameters struct {
 
 	// Environment variables that shall be available during function execution.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	EnvironmentVariables map[string]*string `json:"environmentVariables,omitempty" tf:"environment_variables,omitempty"`
 
 	// Available ingress settings. Defaults to "ALLOW_ALL" if unspecified.
diff --git a/apis/cloudfunctions2/v1beta1/zz_generated_terraformed.go b/apis/cloudfunctions2/v1beta1/zz_generated_terraformed.go
index 4bda8c310..7f5241925 100755
--- a/apis/cloudfunctions2/v1beta1/zz_generated_terraformed.go
+++ b/apis/cloudfunctions2/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Function) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Function
+func (tr *Function) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Function using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Function) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/cloudiot/v1beta1/zz_device_types.go b/apis/cloudiot/v1beta1/zz_device_types.go
index 2b763fdad..9b115c0b0 100755
--- a/apis/cloudiot/v1beta1/zz_device_types.go
+++ b/apis/cloudiot/v1beta1/zz_device_types.go
@@ -104,6 +104,7 @@ type DeviceInitParameters struct {
 	LogLevel *string `json:"logLevel,omitempty" tf:"log_level,omitempty"`
 
 	// The metadata key-value pairs assigned to the device.
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 }
 
@@ -154,6 +155,7 @@ type DeviceObservation struct {
 	LogLevel *string `json:"logLevel,omitempty" tf:"log_level,omitempty"`
 
 	// The metadata key-value pairs assigned to the device.
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// A server-defined unique numeric ID for the device.
@@ -191,6 +193,7 @@ type DeviceParameters struct {
 
 	// The metadata key-value pairs assigned to the device.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// The name of the device registry where this device should be created.
diff --git a/apis/cloudiot/v1beta1/zz_generated_terraformed.go b/apis/cloudiot/v1beta1/zz_generated_terraformed.go
index 0651f7651..fc308f29f 100755
--- a/apis/cloudiot/v1beta1/zz_generated_terraformed.go
+++ b/apis/cloudiot/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Device) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Device
+func (tr *Device) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Device using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Device) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *Registry) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Registry
+func (tr *Registry) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Registry using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Registry) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/cloudplatform/v1beta1/zz_generated_terraformed.go b/apis/cloudplatform/v1beta1/zz_generated_terraformed.go
index c73639a8f..29406545c 100755
--- a/apis/cloudplatform/v1beta1/zz_generated_terraformed.go
+++ b/apis/cloudplatform/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Folder) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Folder
+func (tr *Folder) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Folder using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Folder) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *FolderIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this FolderIAMMember
+func (tr *FolderIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this FolderIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *FolderIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *OrganizationIAMAuditConfig) GetInitParameters() (map[string]any, error
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this OrganizationIAMAuditConfig
+func (tr *OrganizationIAMAuditConfig) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this OrganizationIAMAuditConfig using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *OrganizationIAMAuditConfig) LateInitialize(attrs []byte) (bool, error) {
@@ -347,6 +438,36 @@ func (tr *OrganizationIAMCustomRole) GetInitParameters() (map[string]any, error)
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this OrganizationIAMCustomRole
+func (tr *OrganizationIAMCustomRole) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this OrganizationIAMCustomRole using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *OrganizationIAMCustomRole) LateInitialize(attrs []byte) (bool, error) {
@@ -431,6 +552,36 @@ func (tr *OrganizationIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this OrganizationIAMMember
+func (tr *OrganizationIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this OrganizationIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *OrganizationIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -515,6 +666,36 @@ func (tr *Project) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Project
+func (tr *Project) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Project using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Project) LateInitialize(attrs []byte) (bool, error) {
@@ -599,6 +780,36 @@ func (tr *ProjectDefaultServiceAccounts) GetInitParameters() (map[string]any, er
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ProjectDefaultServiceAccounts
+func (tr *ProjectDefaultServiceAccounts) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ProjectDefaultServiceAccounts using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ProjectDefaultServiceAccounts) LateInitialize(attrs []byte) (bool, error) {
@@ -683,6 +894,36 @@ func (tr *ProjectIAMAuditConfig) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ProjectIAMAuditConfig
+func (tr *ProjectIAMAuditConfig) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ProjectIAMAuditConfig using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ProjectIAMAuditConfig) LateInitialize(attrs []byte) (bool, error) {
@@ -767,6 +1008,36 @@ func (tr *ProjectIAMCustomRole) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ProjectIAMCustomRole
+func (tr *ProjectIAMCustomRole) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ProjectIAMCustomRole using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ProjectIAMCustomRole) LateInitialize(attrs []byte) (bool, error) {
@@ -851,6 +1122,36 @@ func (tr *ProjectIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ProjectIAMMember
+func (tr *ProjectIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ProjectIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ProjectIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -935,6 +1236,36 @@ func (tr *ProjectService) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ProjectService
+func (tr *ProjectService) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ProjectService using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ProjectService) LateInitialize(attrs []byte) (bool, error) {
@@ -1019,6 +1350,36 @@ func (tr *ProjectUsageExportBucket) GetInitParameters() (map[string]any, error)
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ProjectUsageExportBucket
+func (tr *ProjectUsageExportBucket) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ProjectUsageExportBucket using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ProjectUsageExportBucket) LateInitialize(attrs []byte) (bool, error) {
@@ -1103,6 +1464,36 @@ func (tr *ServiceAccount) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ServiceAccount
+func (tr *ServiceAccount) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ServiceAccount using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ServiceAccount) LateInitialize(attrs []byte) (bool, error) {
@@ -1187,6 +1578,36 @@ func (tr *ServiceAccountIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ServiceAccountIAMMember
+func (tr *ServiceAccountIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ServiceAccountIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ServiceAccountIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -1271,6 +1692,36 @@ func (tr *ServiceAccountKey) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ServiceAccountKey
+func (tr *ServiceAccountKey) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ServiceAccountKey using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ServiceAccountKey) LateInitialize(attrs []byte) (bool, error) {
@@ -1355,6 +1806,36 @@ func (tr *ServiceNetworkingPeeredDNSDomain) GetInitParameters() (map[string]any,
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ServiceNetworkingPeeredDNSDomain
+func (tr *ServiceNetworkingPeeredDNSDomain) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ServiceNetworkingPeeredDNSDomain using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ServiceNetworkingPeeredDNSDomain) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/cloudplatform/v1beta1/zz_organizationiamauditconfig_types.go b/apis/cloudplatform/v1beta1/zz_organizationiamauditconfig_types.go
index 758b9bfc1..00a80f5af 100755
--- a/apis/cloudplatform/v1beta1/zz_organizationiamauditconfig_types.go
+++ b/apis/cloudplatform/v1beta1/zz_organizationiamauditconfig_types.go
@@ -30,12 +30,16 @@ import (
 )
 
 type AuditLogConfigInitParameters struct {
+
+	// +listType=set
 	ExemptedMembers []*string `json:"exemptedMembers,omitempty" tf:"exempted_members,omitempty"`
 
 	LogType *string `json:"logType,omitempty" tf:"log_type,omitempty"`
 }
 
 type AuditLogConfigObservation struct {
+
+	// +listType=set
 	ExemptedMembers []*string `json:"exemptedMembers,omitempty" tf:"exempted_members,omitempty"`
 
 	LogType *string `json:"logType,omitempty" tf:"log_type,omitempty"`
@@ -44,6 +48,7 @@ type AuditLogConfigObservation struct {
 type AuditLogConfigParameters struct {
 
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	ExemptedMembers []*string `json:"exemptedMembers,omitempty" tf:"exempted_members,omitempty"`
 
 	// +kubebuilder:validation:Optional
diff --git a/apis/cloudplatform/v1beta1/zz_organizationiamcustomrole_types.go b/apis/cloudplatform/v1beta1/zz_organizationiamcustomrole_types.go
index c578727dc..f39ebf740 100755
--- a/apis/cloudplatform/v1beta1/zz_organizationiamcustomrole_types.go
+++ b/apis/cloudplatform/v1beta1/zz_organizationiamcustomrole_types.go
@@ -38,6 +38,7 @@ type OrganizationIAMCustomRoleInitParameters struct {
 	OrgID *string `json:"orgId,omitempty" tf:"org_id,omitempty"`
 
 	// The names of the permissions this role grants when bound in an IAM policy. At least one permission must be specified.
+	// +listType=set
 	Permissions []*string `json:"permissions,omitempty" tf:"permissions,omitempty"`
 
 	// The role id to use for this role.
@@ -70,6 +71,7 @@ type OrganizationIAMCustomRoleObservation struct {
 	OrgID *string `json:"orgId,omitempty" tf:"org_id,omitempty"`
 
 	// The names of the permissions this role grants when bound in an IAM policy. At least one permission must be specified.
+	// +listType=set
 	Permissions []*string `json:"permissions,omitempty" tf:"permissions,omitempty"`
 
 	// The role id to use for this role.
@@ -96,6 +98,7 @@ type OrganizationIAMCustomRoleParameters struct {
 
 	// The names of the permissions this role grants when bound in an IAM policy. At least one permission must be specified.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Permissions []*string `json:"permissions,omitempty" tf:"permissions,omitempty"`
 
 	// The role id to use for this role.
diff --git a/apis/cloudplatform/v1beta1/zz_project_types.go b/apis/cloudplatform/v1beta1/zz_project_types.go
index 094db881e..8428cd15b 100755
--- a/apis/cloudplatform/v1beta1/zz_project_types.go
+++ b/apis/cloudplatform/v1beta1/zz_project_types.go
@@ -45,6 +45,7 @@ type ProjectInitParameters struct {
 	BillingAccount *string `json:"billingAccount,omitempty" tf:"billing_account,omitempty"`
 
 	// A set of key/value label pairs to assign to the project.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The display name of the project.
@@ -91,6 +92,7 @@ type ProjectObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// A set of key/value label pairs to assign to the project.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The display name of the project.
@@ -151,6 +153,7 @@ type ProjectParameters struct {
 
 	// A set of key/value label pairs to assign to the project.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The display name of the project.
diff --git a/apis/cloudplatform/v1beta1/zz_projectiamauditconfig_types.go b/apis/cloudplatform/v1beta1/zz_projectiamauditconfig_types.go
index c208516b4..4f51c1033 100755
--- a/apis/cloudplatform/v1beta1/zz_projectiamauditconfig_types.go
+++ b/apis/cloudplatform/v1beta1/zz_projectiamauditconfig_types.go
@@ -30,12 +30,16 @@ import (
 )
 
 type ProjectIAMAuditConfigAuditLogConfigInitParameters struct {
+
+	// +listType=set
 	ExemptedMembers []*string `json:"exemptedMembers,omitempty" tf:"exempted_members,omitempty"`
 
 	LogType *string `json:"logType,omitempty" tf:"log_type,omitempty"`
 }
 
 type ProjectIAMAuditConfigAuditLogConfigObservation struct {
+
+	// +listType=set
 	ExemptedMembers []*string `json:"exemptedMembers,omitempty" tf:"exempted_members,omitempty"`
 
 	LogType *string `json:"logType,omitempty" tf:"log_type,omitempty"`
@@ -44,6 +48,7 @@ type ProjectIAMAuditConfigAuditLogConfigObservation struct {
 type ProjectIAMAuditConfigAuditLogConfigParameters struct {
 
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	ExemptedMembers []*string `json:"exemptedMembers,omitempty" tf:"exempted_members,omitempty"`
 
 	// +kubebuilder:validation:Optional
diff --git a/apis/cloudplatform/v1beta1/zz_projectiamcustomrole_types.go b/apis/cloudplatform/v1beta1/zz_projectiamcustomrole_types.go
index 7642c2546..d67c9a1db 100755
--- a/apis/cloudplatform/v1beta1/zz_projectiamcustomrole_types.go
+++ b/apis/cloudplatform/v1beta1/zz_projectiamcustomrole_types.go
@@ -35,6 +35,7 @@ type ProjectIAMCustomRoleInitParameters struct {
 	Description *string `json:"description,omitempty" tf:"description,omitempty"`
 
 	// The names of the permissions this role grants when bound in an IAM policy. At least one permission must be specified.
+	// +listType=set
 	Permissions []*string `json:"permissions,omitempty" tf:"permissions,omitempty"`
 
 	// The project that the service account will be created in.
@@ -65,6 +66,7 @@ type ProjectIAMCustomRoleObservation struct {
 	Name *string `json:"name,omitempty" tf:"name,omitempty"`
 
 	// The names of the permissions this role grants when bound in an IAM policy. At least one permission must be specified.
+	// +listType=set
 	Permissions []*string `json:"permissions,omitempty" tf:"permissions,omitempty"`
 
 	// The project that the service account will be created in.
@@ -88,6 +90,7 @@ type ProjectIAMCustomRoleParameters struct {
 
 	// The names of the permissions this role grants when bound in an IAM policy. At least one permission must be specified.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Permissions []*string `json:"permissions,omitempty" tf:"permissions,omitempty"`
 
 	// The project that the service account will be created in.
diff --git a/apis/cloudrun/v1beta1/zz_domainmapping_types.go b/apis/cloudrun/v1beta1/zz_domainmapping_types.go
index 91f3625f1..dc6d52855 100755
--- a/apis/cloudrun/v1beta1/zz_domainmapping_types.go
+++ b/apis/cloudrun/v1beta1/zz_domainmapping_types.go
@@ -135,12 +135,14 @@ type MetadataInitParameters struct {
 	// may be set by external tools to store and retrieve arbitrary metadata. More
 	// info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
 	// Note: The Cloud Run API may add additional annotations that were not provided in your config.ignore_changes rule to the metadata.0.annotations field.
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Map of string keys and values that can be used to organize and categorize
 	// (scope and select) objects. May match selectors of replication controllers
 	// and routes.
 	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 }
 
@@ -150,6 +152,7 @@ type MetadataObservation struct {
 	// may be set by external tools to store and retrieve arbitrary metadata. More
 	// info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
 	// Note: The Cloud Run API may add additional annotations that were not provided in your config.ignore_changes rule to the metadata.0.annotations field.
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// (Output)
@@ -160,6 +163,7 @@ type MetadataObservation struct {
 	// (scope and select) objects. May match selectors of replication controllers
 	// and routes.
 	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// In Cloud Run the namespace must be equal to either the
@@ -194,6 +198,7 @@ type MetadataParameters struct {
 	// info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
 	// Note: The Cloud Run API may add additional annotations that were not provided in your config.ignore_changes rule to the metadata.0.annotations field.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Map of string keys and values that can be used to organize and categorize
@@ -201,6 +206,7 @@ type MetadataParameters struct {
 	// and routes.
 	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// In Cloud Run the namespace must be equal to either the
diff --git a/apis/cloudrun/v1beta1/zz_generated_terraformed.go b/apis/cloudrun/v1beta1/zz_generated_terraformed.go
index 040bb3586..24a202dce 100755
--- a/apis/cloudrun/v1beta1/zz_generated_terraformed.go
+++ b/apis/cloudrun/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *DomainMapping) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this DomainMapping
+func (tr *DomainMapping) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this DomainMapping using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *DomainMapping) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *Service) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Service
+func (tr *Service) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Service using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Service) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *ServiceIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ServiceIAMMember
+func (tr *ServiceIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ServiceIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ServiceIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -347,6 +438,36 @@ func (tr *V2Job) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this V2Job
+func (tr *V2Job) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this V2Job using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *V2Job) LateInitialize(attrs []byte) (bool, error) {
@@ -431,6 +552,36 @@ func (tr *V2Service) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this V2Service
+func (tr *V2Service) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this V2Service using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *V2Service) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/cloudrun/v1beta1/zz_service_types.go b/apis/cloudrun/v1beta1/zz_service_types.go
index 8721d5852..4825e95b3 100755
--- a/apis/cloudrun/v1beta1/zz_service_types.go
+++ b/apis/cloudrun/v1beta1/zz_service_types.go
@@ -700,6 +700,7 @@ type ResourcesInitParameters struct {
 	// Limits describes the maximum amount of compute resources allowed.
 	// The values of the map is string form of the 'quantity' k8s type:
 	// https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go
+	// +mapType=granular
 	Limits map[string]*string `json:"limits,omitempty" tf:"limits,omitempty"`
 
 	// Requests describes the minimum amount of compute resources required.
@@ -707,6 +708,7 @@ type ResourcesInitParameters struct {
 	// explicitly specified, otherwise to an implementation-defined value.
 	// The values of the map is string form of the 'quantity' k8s type:
 	// https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go
+	// +mapType=granular
 	Requests map[string]*string `json:"requests,omitempty" tf:"requests,omitempty"`
 }
 
@@ -715,6 +717,7 @@ type ResourcesObservation struct {
 	// Limits describes the maximum amount of compute resources allowed.
 	// The values of the map is string form of the 'quantity' k8s type:
 	// https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go
+	// +mapType=granular
 	Limits map[string]*string `json:"limits,omitempty" tf:"limits,omitempty"`
 
 	// Requests describes the minimum amount of compute resources required.
@@ -722,6 +725,7 @@ type ResourcesObservation struct {
 	// explicitly specified, otherwise to an implementation-defined value.
 	// The values of the map is string form of the 'quantity' k8s type:
 	// https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go
+	// +mapType=granular
 	Requests map[string]*string `json:"requests,omitempty" tf:"requests,omitempty"`
 }
 
@@ -731,6 +735,7 @@ type ResourcesParameters struct {
 	// The values of the map is string form of the 'quantity' k8s type:
 	// https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Limits map[string]*string `json:"limits,omitempty" tf:"limits,omitempty"`
 
 	// Requests describes the minimum amount of compute resources required.
@@ -739,6 +744,7 @@ type ResourcesParameters struct {
 	// The values of the map is string form of the 'quantity' k8s type:
 	// https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Requests map[string]*string `json:"requests,omitempty" tf:"requests,omitempty"`
 }
 
@@ -966,10 +972,12 @@ type ServiceMetadataInitParameters struct {
 	// Note: The Cloud Run API may add additional annotations that were not provided in your config.ignore_changes rule to the metadata.0.annotations field.
 	// Annotations with run.googleapis.com/ and autoscaling.knative.dev are restricted. Use the following annotation
 	// keys to configure features on a Revision template:
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Map of string keys and values that can be used to organize and categorize
 	// (scope and select) objects.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 }
 
@@ -981,6 +989,7 @@ type ServiceMetadataObservation struct {
 	// Note: The Cloud Run API may add additional annotations that were not provided in your config.ignore_changes rule to the metadata.0.annotations field.
 	// Annotations with run.googleapis.com/ and autoscaling.knative.dev are restricted. Use the following annotation
 	// keys to configure features on a Revision template:
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// (Output)
@@ -989,6 +998,7 @@ type ServiceMetadataObservation struct {
 
 	// Map of string keys and values that can be used to organize and categorize
 	// (scope and select) objects.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// In Cloud Run the namespace must be equal to either the
@@ -1022,11 +1032,13 @@ type ServiceMetadataParameters struct {
 	// Annotations with run.googleapis.com/ and autoscaling.knative.dev are restricted. Use the following annotation
 	// keys to configure features on a Revision template:
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Map of string keys and values that can be used to organize and categorize
 	// (scope and select) objects.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// In Cloud Run the namespace must be equal to either the
@@ -1526,10 +1538,12 @@ type TemplateMetadataInitParameters struct {
 	// Note: The Cloud Run API may add additional annotations that were not provided in your config.ignore_changes rule to the metadata.0.annotations field.
 	// Annotations with run.googleapis.com/ and autoscaling.knative.dev are restricted. Use the following annotation
 	// keys to configure features on a Revision template:
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Map of string keys and values that can be used to organize and categorize
 	// (scope and select) objects.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Volume's name.
@@ -1548,6 +1562,7 @@ type TemplateMetadataObservation struct {
 	// Note: The Cloud Run API may add additional annotations that were not provided in your config.ignore_changes rule to the metadata.0.annotations field.
 	// Annotations with run.googleapis.com/ and autoscaling.knative.dev are restricted. Use the following annotation
 	// keys to configure features on a Revision template:
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// (Output)
@@ -1556,6 +1571,7 @@ type TemplateMetadataObservation struct {
 
 	// Map of string keys and values that can be used to organize and categorize
 	// (scope and select) objects.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Volume's name.
@@ -1592,11 +1608,13 @@ type TemplateMetadataParameters struct {
 	// Annotations with run.googleapis.com/ and autoscaling.knative.dev are restricted. Use the following annotation
 	// keys to configure features on a Revision template:
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Map of string keys and values that can be used to organize and categorize
 	// (scope and select) objects.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Volume's name.
diff --git a/apis/cloudrun/v1beta1/zz_v2job_types.go b/apis/cloudrun/v1beta1/zz_v2job_types.go
index 3b7aab90f..bb2a94b3f 100755
--- a/apis/cloudrun/v1beta1/zz_v2job_types.go
+++ b/apis/cloudrun/v1beta1/zz_v2job_types.go
@@ -226,12 +226,14 @@ type ContainersPortsParameters struct {
 type ContainersResourcesInitParameters struct {
 
 	// Only memory and CPU are supported. Note: The only supported values for CPU are '1', '2', '4', and '8'. Setting 4 CPU requires at least 2Gi of memory. The values of the map is string form of the 'quantity' k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go
+	// +mapType=granular
 	Limits map[string]*string `json:"limits,omitempty" tf:"limits,omitempty"`
 }
 
 type ContainersResourcesObservation struct {
 
 	// Only memory and CPU are supported. Note: The only supported values for CPU are '1', '2', '4', and '8'. Setting 4 CPU requires at least 2Gi of memory. The values of the map is string form of the 'quantity' k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go
+	// +mapType=granular
 	Limits map[string]*string `json:"limits,omitempty" tf:"limits,omitempty"`
 }
 
@@ -239,6 +241,7 @@ type ContainersResourcesParameters struct {
 
 	// Only memory and CPU are supported. Note: The only supported values for CPU are '1', '2', '4', and '8'. Setting 4 CPU requires at least 2Gi of memory. The values of the map is string form of the 'quantity' k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Limits map[string]*string `json:"limits,omitempty" tf:"limits,omitempty"`
 }
 
@@ -953,6 +956,7 @@ type V2JobInitParameters struct {
 	// Cloud Run API v2 does not support annotations with run.googleapis.com, cloud.googleapis.com, serving.knative.dev, or autoscaling.knative.dev namespaces, and they will be rejected on new resources.
 	// All system annotations in v1 now have a corresponding field in v2 Job.
 	// This field follows Kubernetes annotations' namespacing, limits, and rules.
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Settings for the Binary Authorization feature.
@@ -969,6 +973,7 @@ type V2JobInitParameters struct {
 	// environment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.
 	// Cloud Run API v2 does not support labels with run.googleapis.com, cloud.googleapis.com, serving.knative.dev, or autoscaling.knative.dev namespaces, and they will be rejected.
 	// All system labels in v1 now have a corresponding field in v2 Job.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The launch stage as defined by Google Cloud Platform Launch Stages. Cloud Run supports ALPHA, BETA, and GA.
@@ -992,6 +997,7 @@ type V2JobObservation struct {
 	// Cloud Run API v2 does not support annotations with run.googleapis.com, cloud.googleapis.com, serving.knative.dev, or autoscaling.knative.dev namespaces, and they will be rejected on new resources.
 	// All system annotations in v1 now have a corresponding field in v2 Job.
 	// This field follows Kubernetes annotations' namespacing, limits, and rules.
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Settings for the Binary Authorization feature.
@@ -1024,6 +1030,7 @@ type V2JobObservation struct {
 	// environment, state, etc. For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.
 	// Cloud Run API v2 does not support labels with run.googleapis.com, cloud.googleapis.com, serving.knative.dev, or autoscaling.knative.dev namespaces, and they will be rejected.
 	// All system labels in v1 now have a corresponding field in v2 Job.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Name of the last created execution.
@@ -1071,6 +1078,7 @@ type V2JobParameters struct {
 	// All system annotations in v1 now have a corresponding field in v2 Job.
 	// This field follows Kubernetes annotations' namespacing, limits, and rules.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Settings for the Binary Authorization feature.
@@ -1091,6 +1099,7 @@ type V2JobParameters struct {
 	// Cloud Run API v2 does not support labels with run.googleapis.com, cloud.googleapis.com, serving.knative.dev, or autoscaling.knative.dev namespaces, and they will be rejected.
 	// All system labels in v1 now have a corresponding field in v2 Job.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The launch stage as defined by Google Cloud Platform Launch Stages. Cloud Run supports ALPHA, BETA, and GA.
@@ -1121,6 +1130,7 @@ type V2JobTemplateInitParameters struct {
 	// Cloud Run API v2 does not support annotations with run.googleapis.com, cloud.googleapis.com, serving.knative.dev, or autoscaling.knative.dev namespaces, and they will be rejected.
 	// All system annotations in v1 now have a corresponding field in v2 ExecutionTemplate.
 	// This field follows Kubernetes annotations' namespacing, limits, and rules.
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google's billing system, so they can be used to filter,
@@ -1128,6 +1138,7 @@ type V2JobTemplateInitParameters struct {
 	// https://cloud.google.com/run/docs/configuring/labels.
 	// Cloud Run API v2 does not support labels with run.googleapis.com, cloud.googleapis.com, serving.knative.dev, or autoscaling.knative.dev namespaces, and they will be rejected.
 	// All system labels in v1 now have a corresponding field in v2 ExecutionTemplate.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Specifies the maximum desired number of tasks the execution should run at given time. Must be <= taskCount. When the job is run, if this field is 0 or unset, the maximum possible value will be used for that execution. The actual number of tasks running in steady state will be less than this number when there are fewer tasks waiting to be completed remaining, i.e. when the work left to do is less than max parallelism.
@@ -1147,6 +1158,7 @@ type V2JobTemplateObservation struct {
 	// Cloud Run API v2 does not support annotations with run.googleapis.com, cloud.googleapis.com, serving.knative.dev, or autoscaling.knative.dev namespaces, and they will be rejected.
 	// All system annotations in v1 now have a corresponding field in v2 ExecutionTemplate.
 	// This field follows Kubernetes annotations' namespacing, limits, and rules.
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google's billing system, so they can be used to filter,
@@ -1154,6 +1166,7 @@ type V2JobTemplateObservation struct {
 	// https://cloud.google.com/run/docs/configuring/labels.
 	// Cloud Run API v2 does not support labels with run.googleapis.com, cloud.googleapis.com, serving.knative.dev, or autoscaling.knative.dev namespaces, and they will be rejected.
 	// All system labels in v1 now have a corresponding field in v2 ExecutionTemplate.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Specifies the maximum desired number of tasks the execution should run at given time. Must be <= taskCount. When the job is run, if this field is 0 or unset, the maximum possible value will be used for that execution. The actual number of tasks running in steady state will be less than this number when there are fewer tasks waiting to be completed remaining, i.e. when the work left to do is less than max parallelism.
@@ -1174,6 +1187,7 @@ type V2JobTemplateParameters struct {
 	// All system annotations in v1 now have a corresponding field in v2 ExecutionTemplate.
 	// This field follows Kubernetes annotations' namespacing, limits, and rules.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Unstructured key value map that can be used to organize and categorize objects. User-provided labels are shared with Google's billing system, so they can be used to filter,
@@ -1182,6 +1196,7 @@ type V2JobTemplateParameters struct {
 	// Cloud Run API v2 does not support labels with run.googleapis.com, cloud.googleapis.com, serving.knative.dev, or autoscaling.knative.dev namespaces, and they will be rejected.
 	// All system labels in v1 now have a corresponding field in v2 ExecutionTemplate.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Specifies the maximum desired number of tasks the execution should run at given time. Must be <= taskCount. When the job is run, if this field is 0 or unset, the maximum possible value will be used for that execution. The actual number of tasks running in steady state will be less than this number when there are fewer tasks waiting to be completed remaining, i.e. when the work left to do is less than max parallelism.
diff --git a/apis/cloudrun/v1beta1/zz_v2service_types.go b/apis/cloudrun/v1beta1/zz_v2service_types.go
index 213d390cd..4f5f4a3a6 100755
--- a/apis/cloudrun/v1beta1/zz_v2service_types.go
+++ b/apis/cloudrun/v1beta1/zz_v2service_types.go
@@ -490,6 +490,7 @@ type TemplateContainersResourcesInitParameters struct {
 	CPUIdle *bool `json:"cpuIdle,omitempty" tf:"cpu_idle,omitempty"`
 
 	// Only memory and CPU are supported. Note: The only supported values for CPU are '1', '2', '4', and '8'. Setting 4 CPU requires at least 2Gi of memory. The values of the map is string form of the 'quantity' k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go
+	// +mapType=granular
 	Limits map[string]*string `json:"limits,omitempty" tf:"limits,omitempty"`
 
 	// Determines whether CPU should be boosted on startup of a new container instance above the requested CPU threshold, this can help reduce cold-start latency.
@@ -502,6 +503,7 @@ type TemplateContainersResourcesObservation struct {
 	CPUIdle *bool `json:"cpuIdle,omitempty" tf:"cpu_idle,omitempty"`
 
 	// Only memory and CPU are supported. Note: The only supported values for CPU are '1', '2', '4', and '8'. Setting 4 CPU requires at least 2Gi of memory. The values of the map is string form of the 'quantity' k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go
+	// +mapType=granular
 	Limits map[string]*string `json:"limits,omitempty" tf:"limits,omitempty"`
 
 	// Determines whether CPU should be boosted on startup of a new container instance above the requested CPU threshold, this can help reduce cold-start latency.
@@ -516,6 +518,7 @@ type TemplateContainersResourcesParameters struct {
 
 	// Only memory and CPU are supported. Note: The only supported values for CPU are '1', '2', '4', and '8'. Setting 4 CPU requires at least 2Gi of memory. The values of the map is string form of the 'quantity' k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Limits map[string]*string `json:"limits,omitempty" tf:"limits,omitempty"`
 
 	// Determines whether CPU should be boosted on startup of a new container instance above the requested CPU threshold, this can help reduce cold-start latency.
@@ -870,6 +873,7 @@ type V2ServiceInitParameters struct {
 	// Cloud Run API v2 does not support annotations with run.googleapis.com, cloud.googleapis.com, serving.knative.dev, or autoscaling.knative.dev namespaces, and they will be rejected.
 	// All system annotations in v1 now have a corresponding field in v2 RevisionTemplate.
 	// This field follows Kubernetes annotations' namespacing, limits, and rules.
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Settings for the Binary Authorization feature.
@@ -893,6 +897,7 @@ type V2ServiceInitParameters struct {
 	// For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.
 	// Cloud Run API v2 does not support labels with run.googleapis.com, cloud.googleapis.com, serving.knative.dev, or autoscaling.knative.dev namespaces, and they will be rejected.
 	// All system labels in v1 now have a corresponding field in v2 RevisionTemplate.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The launch stage as defined by Google Cloud Platform Launch Stages. Cloud Run supports ALPHA, BETA, and GA.
@@ -920,6 +925,7 @@ type V2ServiceObservation struct {
 	// Cloud Run API v2 does not support annotations with run.googleapis.com, cloud.googleapis.com, serving.knative.dev, or autoscaling.knative.dev namespaces, and they will be rejected.
 	// All system annotations in v1 now have a corresponding field in v2 RevisionTemplate.
 	// This field follows Kubernetes annotations' namespacing, limits, and rules.
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Settings for the Binary Authorization feature.
@@ -956,6 +962,7 @@ type V2ServiceObservation struct {
 	// For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.
 	// Cloud Run API v2 does not support labels with run.googleapis.com, cloud.googleapis.com, serving.knative.dev, or autoscaling.knative.dev namespaces, and they will be rejected.
 	// All system labels in v1 now have a corresponding field in v2 RevisionTemplate.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Name of the last created revision. See comments in reconciling for additional information on reconciliation process in Cloud Run.
@@ -1016,6 +1023,7 @@ type V2ServiceParameters struct {
 	// All system annotations in v1 now have a corresponding field in v2 RevisionTemplate.
 	// This field follows Kubernetes annotations' namespacing, limits, and rules.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Settings for the Binary Authorization feature.
@@ -1045,6 +1053,7 @@ type V2ServiceParameters struct {
 	// Cloud Run API v2 does not support labels with run.googleapis.com, cloud.googleapis.com, serving.knative.dev, or autoscaling.knative.dev namespaces, and they will be rejected.
 	// All system labels in v1 now have a corresponding field in v2 RevisionTemplate.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The launch stage as defined by Google Cloud Platform Launch Stages. Cloud Run supports ALPHA, BETA, and GA.
@@ -1220,6 +1229,7 @@ type V2ServiceTemplateInitParameters struct {
 	// Cloud Run API v2 does not support annotations with run.googleapis.com, cloud.googleapis.com, serving.knative.dev, or autoscaling.knative.dev namespaces, and they will be rejected.
 	// All system annotations in v1 now have a corresponding field in v2 RevisionTemplate.
 	// This field follows Kubernetes annotations' namespacing, limits, and rules.
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Holds the containers that define the unit of execution for this Service.
@@ -1237,6 +1247,7 @@ type V2ServiceTemplateInitParameters struct {
 	// For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.
 	// Cloud Run API v2 does not support labels with run.googleapis.com, cloud.googleapis.com, serving.knative.dev, or autoscaling.knative.dev namespaces, and they will be rejected.
 	// All system labels in v1 now have a corresponding field in v2 RevisionTemplate.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Sets the maximum number of requests that each serving instance can receive.
@@ -1274,6 +1285,7 @@ type V2ServiceTemplateObservation struct {
 	// Cloud Run API v2 does not support annotations with run.googleapis.com, cloud.googleapis.com, serving.knative.dev, or autoscaling.knative.dev namespaces, and they will be rejected.
 	// All system annotations in v1 now have a corresponding field in v2 RevisionTemplate.
 	// This field follows Kubernetes annotations' namespacing, limits, and rules.
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Holds the containers that define the unit of execution for this Service.
@@ -1291,6 +1303,7 @@ type V2ServiceTemplateObservation struct {
 	// For more information, visit https://cloud.google.com/resource-manager/docs/creating-managing-labels or https://cloud.google.com/run/docs/configuring/labels.
 	// Cloud Run API v2 does not support labels with run.googleapis.com, cloud.googleapis.com, serving.knative.dev, or autoscaling.knative.dev namespaces, and they will be rejected.
 	// All system labels in v1 now have a corresponding field in v2 RevisionTemplate.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Sets the maximum number of requests that each serving instance can receive.
@@ -1329,6 +1342,7 @@ type V2ServiceTemplateParameters struct {
 	// All system annotations in v1 now have a corresponding field in v2 RevisionTemplate.
 	// This field follows Kubernetes annotations' namespacing, limits, and rules.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Holds the containers that define the unit of execution for this Service.
@@ -1350,6 +1364,7 @@ type V2ServiceTemplateParameters struct {
 	// Cloud Run API v2 does not support labels with run.googleapis.com, cloud.googleapis.com, serving.knative.dev, or autoscaling.knative.dev namespaces, and they will be rejected.
 	// All system labels in v1 now have a corresponding field in v2 RevisionTemplate.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Sets the maximum number of requests that each serving instance can receive.
diff --git a/apis/cloudscheduler/v1beta1/zz_generated_terraformed.go b/apis/cloudscheduler/v1beta1/zz_generated_terraformed.go
index 77ab80946..f9c9f87cb 100755
--- a/apis/cloudscheduler/v1beta1/zz_generated_terraformed.go
+++ b/apis/cloudscheduler/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Job) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Job
+func (tr *Job) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Job using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Job) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/cloudscheduler/v1beta1/zz_job_types.go b/apis/cloudscheduler/v1beta1/zz_job_types.go
index c08a7b5ef..4bf58427a 100755
--- a/apis/cloudscheduler/v1beta1/zz_job_types.go
+++ b/apis/cloudscheduler/v1beta1/zz_job_types.go
@@ -47,6 +47,7 @@ type AppEngineHTTPTargetInitParameters struct {
 	// HTTP request headers.
 	// This map contains the header field names and values.
 	// Headers can be set when the job is created.
+	// +mapType=granular
 	Headers map[string]*string `json:"headers,omitempty" tf:"headers,omitempty"`
 
 	// The relative URI.
@@ -75,6 +76,7 @@ type AppEngineHTTPTargetObservation struct {
 	// HTTP request headers.
 	// This map contains the header field names and values.
 	// Headers can be set when the job is created.
+	// +mapType=granular
 	Headers map[string]*string `json:"headers,omitempty" tf:"headers,omitempty"`
 
 	// The relative URI.
@@ -107,6 +109,7 @@ type AppEngineHTTPTargetParameters struct {
 	// This map contains the header field names and values.
 	// Headers can be set when the job is created.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Headers map[string]*string `json:"headers,omitempty" tf:"headers,omitempty"`
 
 	// The relative URI.
@@ -179,6 +182,7 @@ type HTTPTargetInitParameters struct {
 
 	// This map contains the header field names and values.
 	// Repeated headers are not supported, but a header value can contain commas.
+	// +mapType=granular
 	Headers map[string]*string `json:"headers,omitempty" tf:"headers,omitempty"`
 
 	// Contains information needed for generating an OAuth token.
@@ -208,6 +212,7 @@ type HTTPTargetObservation struct {
 
 	// This map contains the header field names and values.
 	// Repeated headers are not supported, but a header value can contain commas.
+	// +mapType=granular
 	Headers map[string]*string `json:"headers,omitempty" tf:"headers,omitempty"`
 
 	// Contains information needed for generating an OAuth token.
@@ -240,6 +245,7 @@ type HTTPTargetParameters struct {
 	// This map contains the header field names and values.
 	// Repeated headers are not supported, but a header value can contain commas.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Headers map[string]*string `json:"headers,omitempty" tf:"headers,omitempty"`
 
 	// Contains information needed for generating an OAuth token.
@@ -509,6 +515,7 @@ type PubsubTargetInitParameters struct {
 
 	// Attributes for PubsubMessage.
 	// Pubsub message must contain either non-empty data, or at least one attribute.
+	// +mapType=granular
 	Attributes map[string]*string `json:"attributes,omitempty" tf:"attributes,omitempty"`
 
 	// The message payload for PubsubMessage.
@@ -521,6 +528,7 @@ type PubsubTargetObservation struct {
 
 	// Attributes for PubsubMessage.
 	// Pubsub message must contain either non-empty data, or at least one attribute.
+	// +mapType=granular
 	Attributes map[string]*string `json:"attributes,omitempty" tf:"attributes,omitempty"`
 
 	// The message payload for PubsubMessage.
@@ -540,6 +548,7 @@ type PubsubTargetParameters struct {
 	// Attributes for PubsubMessage.
 	// Pubsub message must contain either non-empty data, or at least one attribute.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Attributes map[string]*string `json:"attributes,omitempty" tf:"attributes,omitempty"`
 
 	// The message payload for PubsubMessage.
diff --git a/apis/cloudtasks/v1beta1/zz_generated_terraformed.go b/apis/cloudtasks/v1beta1/zz_generated_terraformed.go
index ae3e600ae..85c3298ef 100755
--- a/apis/cloudtasks/v1beta1/zz_generated_terraformed.go
+++ b/apis/cloudtasks/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Queue) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Queue
+func (tr *Queue) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Queue using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Queue) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/composer/v1beta1/zz_environment_types.go b/apis/composer/v1beta1/zz_environment_types.go
index 029b9045a..099199e9f 100755
--- a/apis/composer/v1beta1/zz_environment_types.go
+++ b/apis/composer/v1beta1/zz_environment_types.go
@@ -368,6 +368,7 @@ type EnvironmentInitParameters struct {
 	// conform to the regular expression ([a-z]([-a-z0-9]*[a-z0-9])?)?.
 	// No more than 64 labels can be associated with a given environment.
 	// Both keys and values must be <= 128 bytes in size.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 }
 
@@ -388,6 +389,7 @@ type EnvironmentObservation struct {
 	// conform to the regular expression ([a-z]([-a-z0-9]*[a-z0-9])?)?.
 	// No more than 64 labels can be associated with a given environment.
 	// Both keys and values must be <= 128 bytes in size.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -414,6 +416,7 @@ type EnvironmentParameters struct {
 	// No more than 64 labels can be associated with a given environment.
 	// Both keys and values must be <= 128 bytes in size.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -648,12 +651,14 @@ type NodeConfigInitParameters struct {
 	// The set of Google API scopes to be made available on all node
 	// VMs. Cannot be updated. If empty, defaults to
 	// ["https://www.googleapis.com/auth/cloud-platform"].
+	// +listType=set
 	OAuthScopes []*string `json:"oauthScopes,omitempty" tf:"oauth_scopes,omitempty"`
 
 	// The list of instance tags applied to all node VMs. Tags are
 	// used to identify valid sources or targets for network
 	// firewalls. Each tag within the list must comply with RFC1035.
 	// Cannot be updated.
+	// +listType=set
 	Tags []*string `json:"tags,omitempty" tf:"tags,omitempty"`
 
 	// The Compute Engine zone in which to deploy the VMs running the
@@ -694,6 +699,7 @@ type NodeConfigObservation struct {
 	// The set of Google API scopes to be made available on all node
 	// VMs. Cannot be updated. If empty, defaults to
 	// ["https://www.googleapis.com/auth/cloud-platform"].
+	// +listType=set
 	OAuthScopes []*string `json:"oauthScopes,omitempty" tf:"oauth_scopes,omitempty"`
 
 	// The Google Cloud Platform Service Account to be used by the
@@ -713,6 +719,7 @@ type NodeConfigObservation struct {
 	// used to identify valid sources or targets for network
 	// firewalls. Each tag within the list must comply with RFC1035.
 	// Cannot be updated.
+	// +listType=set
 	Tags []*string `json:"tags,omitempty" tf:"tags,omitempty"`
 
 	// The Compute Engine zone in which to deploy the VMs running the
@@ -769,6 +776,7 @@ type NodeConfigParameters struct {
 	// VMs. Cannot be updated. If empty, defaults to
 	// ["https://www.googleapis.com/auth/cloud-platform"].
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	OAuthScopes []*string `json:"oauthScopes,omitempty" tf:"oauth_scopes,omitempty"`
 
 	// The Google Cloud Platform Service Account to be used by the
@@ -811,6 +819,7 @@ type NodeConfigParameters struct {
 	// firewalls. Each tag within the list must comply with RFC1035.
 	// Cannot be updated.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Tags []*string `json:"tags,omitempty" tf:"tags,omitempty"`
 
 	// The Compute Engine zone in which to deploy the VMs running the
@@ -1048,12 +1057,14 @@ type SoftwareConfigInitParameters struct {
 
 	// Apache Airflow configuration properties to override. Property keys contain the section and property names,
 	// separated by a hyphen, for example "core-dags_are_paused_at_creation".
+	// +mapType=granular
 	AirflowConfigOverrides map[string]*string `json:"airflowConfigOverrides,omitempty" tf:"airflow_config_overrides,omitempty"`
 
 	// Additional environment variables to provide to the Apache Airflow scheduler, worker, and webserver processes.
 	// Environment variable names must match the regular expression [a-zA-Z_][a-zA-Z0-9_]*.
 	// They cannot specify Apache Airflow software configuration overrides (they cannot match the regular expression
 	// AIRFLOW__[A-Z0-9_]+__[A-Z0-9_]+), and they cannot match any of the following reserved names:
+	// +mapType=granular
 	EnvVariables map[string]*string `json:"envVariables,omitempty" tf:"env_variables,omitempty"`
 
 	ImageVersion *string `json:"imageVersion,omitempty" tf:"image_version,omitempty"`
@@ -1062,6 +1073,7 @@ type SoftwareConfigInitParameters struct {
 	// in the environment. Keys refer to the lowercase package name (e.g. "numpy"). Values are the lowercase extras and
 	// version specifier (e.g. "==1.12.0", "[devel,gcp_api]", "[devel]>=1.8.2, <1.9.2"). To specify a package without
 	// pinning it to a version specifier, use the empty string as the value.
+	// +mapType=granular
 	PypiPackages map[string]*string `json:"pypiPackages,omitempty" tf:"pypi_packages,omitempty"`
 
 	// The major version of Python used to run the Apache Airflow scheduler, worker, and webserver processes.
@@ -1076,12 +1088,14 @@ type SoftwareConfigObservation struct {
 
 	// Apache Airflow configuration properties to override. Property keys contain the section and property names,
 	// separated by a hyphen, for example "core-dags_are_paused_at_creation".
+	// +mapType=granular
 	AirflowConfigOverrides map[string]*string `json:"airflowConfigOverrides,omitempty" tf:"airflow_config_overrides,omitempty"`
 
 	// Additional environment variables to provide to the Apache Airflow scheduler, worker, and webserver processes.
 	// Environment variable names must match the regular expression [a-zA-Z_][a-zA-Z0-9_]*.
 	// They cannot specify Apache Airflow software configuration overrides (they cannot match the regular expression
 	// AIRFLOW__[A-Z0-9_]+__[A-Z0-9_]+), and they cannot match any of the following reserved names:
+	// +mapType=granular
 	EnvVariables map[string]*string `json:"envVariables,omitempty" tf:"env_variables,omitempty"`
 
 	ImageVersion *string `json:"imageVersion,omitempty" tf:"image_version,omitempty"`
@@ -1090,6 +1104,7 @@ type SoftwareConfigObservation struct {
 	// in the environment. Keys refer to the lowercase package name (e.g. "numpy"). Values are the lowercase extras and
 	// version specifier (e.g. "==1.12.0", "[devel,gcp_api]", "[devel]>=1.8.2, <1.9.2"). To specify a package without
 	// pinning it to a version specifier, use the empty string as the value.
+	// +mapType=granular
 	PypiPackages map[string]*string `json:"pypiPackages,omitempty" tf:"pypi_packages,omitempty"`
 
 	// The major version of Python used to run the Apache Airflow scheduler, worker, and webserver processes.
@@ -1105,6 +1120,7 @@ type SoftwareConfigParameters struct {
 	// Apache Airflow configuration properties to override. Property keys contain the section and property names,
 	// separated by a hyphen, for example "core-dags_are_paused_at_creation".
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	AirflowConfigOverrides map[string]*string `json:"airflowConfigOverrides,omitempty" tf:"airflow_config_overrides,omitempty"`
 
 	// Additional environment variables to provide to the Apache Airflow scheduler, worker, and webserver processes.
@@ -1112,6 +1128,7 @@ type SoftwareConfigParameters struct {
 	// They cannot specify Apache Airflow software configuration overrides (they cannot match the regular expression
 	// AIRFLOW__[A-Z0-9_]+__[A-Z0-9_]+), and they cannot match any of the following reserved names:
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	EnvVariables map[string]*string `json:"envVariables,omitempty" tf:"env_variables,omitempty"`
 
 	// +kubebuilder:validation:Optional
@@ -1122,6 +1139,7 @@ type SoftwareConfigParameters struct {
 	// version specifier (e.g. "==1.12.0", "[devel,gcp_api]", "[devel]>=1.8.2, <1.9.2"). To specify a package without
 	// pinning it to a version specifier, use the empty string as the value.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	PypiPackages map[string]*string `json:"pypiPackages,omitempty" tf:"pypi_packages,omitempty"`
 
 	// The major version of Python used to run the Apache Airflow scheduler, worker, and webserver processes.
diff --git a/apis/composer/v1beta1/zz_generated_terraformed.go b/apis/composer/v1beta1/zz_generated_terraformed.go
index 1b2760f70..79f52bc43 100755
--- a/apis/composer/v1beta1/zz_generated_terraformed.go
+++ b/apis/composer/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Environment) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Environment
+func (tr *Environment) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Environment using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Environment) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/compute/v1beta1/zz_backendservice_types.go b/apis/compute/v1beta1/zz_backendservice_types.go
index b047eaca3..ef64fb8f6 100755
--- a/apis/compute/v1beta1/zz_backendservice_types.go
+++ b/apis/compute/v1beta1/zz_backendservice_types.go
@@ -495,10 +495,12 @@ type BackendServiceInitParameters struct {
 
 	// Headers that the HTTP/S load balancer should add to proxied
 	// requests.
+	// +listType=set
 	CustomRequestHeaders []*string `json:"customRequestHeaders,omitempty" tf:"custom_request_headers,omitempty"`
 
 	// Headers that the HTTP/S load balancer should add to proxied
 	// responses.
+	// +listType=set
 	CustomResponseHeaders []*string `json:"customResponseHeaders,omitempty" tf:"custom_response_headers,omitempty"`
 
 	// An optional description of this resource.
@@ -627,10 +629,12 @@ type BackendServiceObservation struct {
 
 	// Headers that the HTTP/S load balancer should add to proxied
 	// requests.
+	// +listType=set
 	CustomRequestHeaders []*string `json:"customRequestHeaders,omitempty" tf:"custom_request_headers,omitempty"`
 
 	// Headers that the HTTP/S load balancer should add to proxied
 	// responses.
+	// +listType=set
 	CustomResponseHeaders []*string `json:"customResponseHeaders,omitempty" tf:"custom_response_headers,omitempty"`
 
 	// An optional description of this resource.
@@ -655,6 +659,7 @@ type BackendServiceObservation struct {
 	// A health check must be specified unless the backend service uses an internet
 	// or serverless NEG as a backend.
 	// For internal load balancing, a URL to a HealthCheck resource must be specified instead.
+	// +listType=set
 	HealthChecks []*string `json:"healthChecks,omitempty" tf:"health_checks,omitempty"`
 
 	// an identifier for the resource with format projects/{{project}}/global/backendServices/{{name}}
@@ -785,11 +790,13 @@ type BackendServiceParameters struct {
 	// Headers that the HTTP/S load balancer should add to proxied
 	// requests.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	CustomRequestHeaders []*string `json:"customRequestHeaders,omitempty" tf:"custom_request_headers,omitempty"`
 
 	// Headers that the HTTP/S load balancer should add to proxied
 	// responses.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	CustomResponseHeaders []*string `json:"customResponseHeaders,omitempty" tf:"custom_response_headers,omitempty"`
 
 	// An optional description of this resource.
@@ -813,6 +820,7 @@ type BackendServiceParameters struct {
 	// +crossplane:generate:reference:type=HealthCheck
 	// +crossplane:generate:reference:extractor=github.com/upbound/provider-gcp/config/common.SelfLinkExtractor()
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	HealthChecks []*string `json:"healthChecks,omitempty" tf:"health_checks,omitempty"`
 
 	// References to HealthCheck to populate healthChecks.
@@ -995,6 +1003,7 @@ type CdnPolicyCacheKeyPolicyInitParameters struct {
 	// query_string_whitelist or query_string_blacklist, not both.
 	// '&' and '=' will be percent encoded and not treated as
 	// delimiters.
+	// +listType=set
 	QueryStringBlacklist []*string `json:"queryStringBlacklist,omitempty" tf:"query_string_blacklist,omitempty"`
 
 	// Names of query string parameters to include in cache keys.
@@ -1002,6 +1011,7 @@ type CdnPolicyCacheKeyPolicyInitParameters struct {
 	// query_string_whitelist or query_string_blacklist, not both.
 	// '&' and '=' will be percent encoded and not treated as
 	// delimiters.
+	// +listType=set
 	QueryStringWhitelist []*string `json:"queryStringWhitelist,omitempty" tf:"query_string_whitelist,omitempty"`
 }
 
@@ -1033,6 +1043,7 @@ type CdnPolicyCacheKeyPolicyObservation struct {
 	// query_string_whitelist or query_string_blacklist, not both.
 	// '&' and '=' will be percent encoded and not treated as
 	// delimiters.
+	// +listType=set
 	QueryStringBlacklist []*string `json:"queryStringBlacklist,omitempty" tf:"query_string_blacklist,omitempty"`
 
 	// Names of query string parameters to include in cache keys.
@@ -1040,6 +1051,7 @@ type CdnPolicyCacheKeyPolicyObservation struct {
 	// query_string_whitelist or query_string_blacklist, not both.
 	// '&' and '=' will be percent encoded and not treated as
 	// delimiters.
+	// +listType=set
 	QueryStringWhitelist []*string `json:"queryStringWhitelist,omitempty" tf:"query_string_whitelist,omitempty"`
 }
 
@@ -1077,6 +1089,7 @@ type CdnPolicyCacheKeyPolicyParameters struct {
 	// '&' and '=' will be percent encoded and not treated as
 	// delimiters.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	QueryStringBlacklist []*string `json:"queryStringBlacklist,omitempty" tf:"query_string_blacklist,omitempty"`
 
 	// Names of query string parameters to include in cache keys.
@@ -1085,6 +1098,7 @@ type CdnPolicyCacheKeyPolicyParameters struct {
 	// '&' and '=' will be percent encoded and not treated as
 	// delimiters.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	QueryStringWhitelist []*string `json:"queryStringWhitelist,omitempty" tf:"query_string_whitelist,omitempty"`
 }
 
diff --git a/apis/compute/v1beta1/zz_disk_types.go b/apis/compute/v1beta1/zz_disk_types.go
index e8e077fa4..a91a362a7 100755
--- a/apis/compute/v1beta1/zz_disk_types.go
+++ b/apis/compute/v1beta1/zz_disk_types.go
@@ -156,6 +156,7 @@ type DiskInitParameters struct {
 	Image *string `json:"image,omitempty" tf:"image,omitempty"`
 
 	// Labels to apply to this disk.  A list of key->value pairs.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Any applicable license URI.
@@ -268,6 +269,7 @@ type DiskObservation struct {
 	LabelFingerprint *string `json:"labelFingerprint,omitempty" tf:"label_fingerprint,omitempty"`
 
 	// Labels to apply to this disk.  A list of key->value pairs.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Last attach timestamp in RFC3339 text format.
@@ -412,6 +414,7 @@ type DiskParameters struct {
 
 	// Labels to apply to this disk.  A list of key->value pairs.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Any applicable license URI.
diff --git a/apis/compute/v1beta1/zz_externalvpngateway_types.go b/apis/compute/v1beta1/zz_externalvpngateway_types.go
index 031cda99c..b1db47e9d 100755
--- a/apis/compute/v1beta1/zz_externalvpngateway_types.go
+++ b/apis/compute/v1beta1/zz_externalvpngateway_types.go
@@ -39,6 +39,7 @@ type ExternalVPNGatewayInitParameters struct {
 	Interface []InterfaceInitParameters `json:"interface,omitempty" tf:"interface,omitempty"`
 
 	// Labels for the external VPN gateway resource.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -67,6 +68,7 @@ type ExternalVPNGatewayObservation struct {
 	LabelFingerprint *string `json:"labelFingerprint,omitempty" tf:"label_fingerprint,omitempty"`
 
 	// Labels for the external VPN gateway resource.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -94,6 +96,7 @@ type ExternalVPNGatewayParameters struct {
 
 	// Labels for the external VPN gateway resource.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
diff --git a/apis/compute/v1beta1/zz_firewall_types.go b/apis/compute/v1beta1/zz_firewall_types.go
index 72ca94736..095183dec 100755
--- a/apis/compute/v1beta1/zz_firewall_types.go
+++ b/apis/compute/v1beta1/zz_firewall_types.go
@@ -155,6 +155,7 @@ type FirewallInitParameters struct {
 	// If destination ranges are specified, the firewall will apply only to
 	// traffic that has destination IP address in these ranges. These ranges
 	// must be expressed in CIDR format. IPv4 or IPv6 ranges are supported.
+	// +listType=set
 	DestinationRanges []*string `json:"destinationRanges,omitempty" tf:"destination_ranges,omitempty"`
 
 	// Direction of traffic to which this firewall applies; default is
@@ -199,6 +200,7 @@ type FirewallInitParameters struct {
 	// connection does not need to match both properties for the firewall to
 	// apply. IPv4 or IPv6 ranges are supported. For INGRESS traffic, one of
 	// source_ranges, source_tags or source_service_accounts is required.
+	// +listType=set
 	SourceRanges []*string `json:"sourceRanges,omitempty" tf:"source_ranges,omitempty"`
 
 	// If source service accounts are specified, the firewall will apply only
@@ -213,6 +215,7 @@ type FirewallInitParameters struct {
 	// properties for the firewall to apply. sourceServiceAccounts cannot be
 	// used at the same time as sourceTags or targetTags. For INGRESS traffic,
 	// one of source_ranges, source_tags or source_service_accounts is required.
+	// +listType=set
 	SourceServiceAccounts []*string `json:"sourceServiceAccounts,omitempty" tf:"source_service_accounts,omitempty"`
 
 	// If source tags are specified, the firewall will apply only to traffic
@@ -225,6 +228,7 @@ type FirewallInitParameters struct {
 	// a tag listed in the sourceTags property. The connection does not need
 	// to match both properties for the firewall to apply. For INGRESS traffic,
 	// one of source_ranges, source_tags or source_service_accounts is required.
+	// +listType=set
 	SourceTags []*string `json:"sourceTags,omitempty" tf:"source_tags,omitempty"`
 
 	// A list of service accounts indicating sets of instances located in the
@@ -233,12 +237,14 @@ type FirewallInitParameters struct {
 	// sourceTags. If neither targetServiceAccounts nor targetTags are
 	// specified, the firewall rule applies to all instances on the specified
 	// network.
+	// +listType=set
 	TargetServiceAccounts []*string `json:"targetServiceAccounts,omitempty" tf:"target_service_accounts,omitempty"`
 
 	// A list of instance tags indicating sets of instances located in the
 	// network that may make network connections as specified in allowed[].
 	// If no targetTags are specified, the firewall rule applies to all
 	// instances on the specified network.
+	// +listType=set
 	TargetTags []*string `json:"targetTags,omitempty" tf:"target_tags,omitempty"`
 }
 
@@ -287,6 +293,7 @@ type FirewallObservation struct {
 	// If destination ranges are specified, the firewall will apply only to
 	// traffic that has destination IP address in these ranges. These ranges
 	// must be expressed in CIDR format. IPv4 or IPv6 ranges are supported.
+	// +listType=set
 	DestinationRanges []*string `json:"destinationRanges,omitempty" tf:"destination_ranges,omitempty"`
 
 	// Direction of traffic to which this firewall applies; default is
@@ -340,6 +347,7 @@ type FirewallObservation struct {
 	// connection does not need to match both properties for the firewall to
 	// apply. IPv4 or IPv6 ranges are supported. For INGRESS traffic, one of
 	// source_ranges, source_tags or source_service_accounts is required.
+	// +listType=set
 	SourceRanges []*string `json:"sourceRanges,omitempty" tf:"source_ranges,omitempty"`
 
 	// If source service accounts are specified, the firewall will apply only
@@ -354,6 +362,7 @@ type FirewallObservation struct {
 	// properties for the firewall to apply. sourceServiceAccounts cannot be
 	// used at the same time as sourceTags or targetTags. For INGRESS traffic,
 	// one of source_ranges, source_tags or source_service_accounts is required.
+	// +listType=set
 	SourceServiceAccounts []*string `json:"sourceServiceAccounts,omitempty" tf:"source_service_accounts,omitempty"`
 
 	// If source tags are specified, the firewall will apply only to traffic
@@ -366,6 +375,7 @@ type FirewallObservation struct {
 	// a tag listed in the sourceTags property. The connection does not need
 	// to match both properties for the firewall to apply. For INGRESS traffic,
 	// one of source_ranges, source_tags or source_service_accounts is required.
+	// +listType=set
 	SourceTags []*string `json:"sourceTags,omitempty" tf:"source_tags,omitempty"`
 
 	// A list of service accounts indicating sets of instances located in the
@@ -374,12 +384,14 @@ type FirewallObservation struct {
 	// sourceTags. If neither targetServiceAccounts nor targetTags are
 	// specified, the firewall rule applies to all instances on the specified
 	// network.
+	// +listType=set
 	TargetServiceAccounts []*string `json:"targetServiceAccounts,omitempty" tf:"target_service_accounts,omitempty"`
 
 	// A list of instance tags indicating sets of instances located in the
 	// network that may make network connections as specified in allowed[].
 	// If no targetTags are specified, the firewall rule applies to all
 	// instances on the specified network.
+	// +listType=set
 	TargetTags []*string `json:"targetTags,omitempty" tf:"target_tags,omitempty"`
 }
 
@@ -407,6 +419,7 @@ type FirewallParameters struct {
 	// traffic that has destination IP address in these ranges. These ranges
 	// must be expressed in CIDR format. IPv4 or IPv6 ranges are supported.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	DestinationRanges []*string `json:"destinationRanges,omitempty" tf:"destination_ranges,omitempty"`
 
 	// Direction of traffic to which this firewall applies; default is
@@ -472,6 +485,7 @@ type FirewallParameters struct {
 	// apply. IPv4 or IPv6 ranges are supported. For INGRESS traffic, one of
 	// source_ranges, source_tags or source_service_accounts is required.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	SourceRanges []*string `json:"sourceRanges,omitempty" tf:"source_ranges,omitempty"`
 
 	// If source service accounts are specified, the firewall will apply only
@@ -487,6 +501,7 @@ type FirewallParameters struct {
 	// used at the same time as sourceTags or targetTags. For INGRESS traffic,
 	// one of source_ranges, source_tags or source_service_accounts is required.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	SourceServiceAccounts []*string `json:"sourceServiceAccounts,omitempty" tf:"source_service_accounts,omitempty"`
 
 	// If source tags are specified, the firewall will apply only to traffic
@@ -500,6 +515,7 @@ type FirewallParameters struct {
 	// to match both properties for the firewall to apply. For INGRESS traffic,
 	// one of source_ranges, source_tags or source_service_accounts is required.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	SourceTags []*string `json:"sourceTags,omitempty" tf:"source_tags,omitempty"`
 
 	// A list of service accounts indicating sets of instances located in the
@@ -509,6 +525,7 @@ type FirewallParameters struct {
 	// specified, the firewall rule applies to all instances on the specified
 	// network.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	TargetServiceAccounts []*string `json:"targetServiceAccounts,omitempty" tf:"target_service_accounts,omitempty"`
 
 	// A list of instance tags indicating sets of instances located in the
@@ -516,6 +533,7 @@ type FirewallParameters struct {
 	// If no targetTags are specified, the firewall rule applies to all
 	// instances on the specified network.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	TargetTags []*string `json:"targetTags,omitempty" tf:"target_tags,omitempty"`
 }
 
diff --git a/apis/compute/v1beta1/zz_forwardingrule_types.go b/apis/compute/v1beta1/zz_forwardingrule_types.go
index 119fe581d..b7513b262 100755
--- a/apis/compute/v1beta1/zz_forwardingrule_types.go
+++ b/apis/compute/v1beta1/zz_forwardingrule_types.go
@@ -70,6 +70,7 @@ type ForwardingRuleInitParameters struct {
 	IsMirroringCollector *bool `json:"isMirroringCollector,omitempty" tf:"is_mirroring_collector,omitempty"`
 
 	// Labels to apply to this forwarding rule.  A list of key->value pairs.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Specifies the forwarding rule type.
@@ -104,6 +105,7 @@ type ForwardingRuleInitParameters struct {
 	// For internal forwarding rules within the same VPC network, two or more
 	// forwarding rules cannot use the same [IPAddress, IPProtocol]
 	// pair, and cannot have overlapping portRanges.
+	// +listType=set
 	Ports []*string `json:"ports,omitempty" tf:"ports,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -197,6 +199,7 @@ type ForwardingRuleObservation struct {
 	LabelFingerprint *string `json:"labelFingerprint,omitempty" tf:"label_fingerprint,omitempty"`
 
 	// Labels to apply to this forwarding rule.  A list of key->value pairs.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Specifies the forwarding rule type.
@@ -241,6 +244,7 @@ type ForwardingRuleObservation struct {
 	// For internal forwarding rules within the same VPC network, two or more
 	// forwarding rules cannot use the same [IPAddress, IPProtocol]
 	// pair, and cannot have overlapping portRanges.
+	// +listType=set
 	Ports []*string `json:"ports,omitempty" tf:"ports,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -380,6 +384,7 @@ type ForwardingRuleParameters struct {
 
 	// Labels to apply to this forwarding rule.  A list of key->value pairs.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Specifies the forwarding rule type.
@@ -440,6 +445,7 @@ type ForwardingRuleParameters struct {
 	// forwarding rules cannot use the same [IPAddress, IPProtocol]
 	// pair, and cannot have overlapping portRanges.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Ports []*string `json:"ports,omitempty" tf:"ports,omitempty"`
 
 	// The ID of the project in which the resource belongs.
diff --git a/apis/compute/v1beta1/zz_generated_terraformed.go b/apis/compute/v1beta1/zz_generated_terraformed.go
index 0ed7c6540..0ca8e7e81 100755
--- a/apis/compute/v1beta1/zz_generated_terraformed.go
+++ b/apis/compute/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Address) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Address
+func (tr *Address) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Address using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Address) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *AttachedDisk) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this AttachedDisk
+func (tr *AttachedDisk) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this AttachedDisk using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *AttachedDisk) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *Autoscaler) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Autoscaler
+func (tr *Autoscaler) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Autoscaler using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Autoscaler) LateInitialize(attrs []byte) (bool, error) {
@@ -347,6 +438,36 @@ func (tr *BackendBucket) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this BackendBucket
+func (tr *BackendBucket) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this BackendBucket using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *BackendBucket) LateInitialize(attrs []byte) (bool, error) {
@@ -431,6 +552,36 @@ func (tr *BackendBucketSignedURLKey) GetInitParameters() (map[string]any, error)
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this BackendBucketSignedURLKey
+func (tr *BackendBucketSignedURLKey) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this BackendBucketSignedURLKey using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *BackendBucketSignedURLKey) LateInitialize(attrs []byte) (bool, error) {
@@ -515,6 +666,36 @@ func (tr *BackendService) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this BackendService
+func (tr *BackendService) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this BackendService using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *BackendService) LateInitialize(attrs []byte) (bool, error) {
@@ -599,6 +780,36 @@ func (tr *BackendServiceSignedURLKey) GetInitParameters() (map[string]any, error
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this BackendServiceSignedURLKey
+func (tr *BackendServiceSignedURLKey) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this BackendServiceSignedURLKey using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *BackendServiceSignedURLKey) LateInitialize(attrs []byte) (bool, error) {
@@ -683,6 +894,36 @@ func (tr *Disk) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Disk
+func (tr *Disk) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Disk using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Disk) LateInitialize(attrs []byte) (bool, error) {
@@ -767,6 +1008,36 @@ func (tr *DiskIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this DiskIAMMember
+func (tr *DiskIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this DiskIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *DiskIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -851,6 +1122,36 @@ func (tr *DiskResourcePolicyAttachment) GetInitParameters() (map[string]any, err
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this DiskResourcePolicyAttachment
+func (tr *DiskResourcePolicyAttachment) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this DiskResourcePolicyAttachment using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *DiskResourcePolicyAttachment) LateInitialize(attrs []byte) (bool, error) {
@@ -935,6 +1236,36 @@ func (tr *ExternalVPNGateway) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ExternalVPNGateway
+func (tr *ExternalVPNGateway) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ExternalVPNGateway using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ExternalVPNGateway) LateInitialize(attrs []byte) (bool, error) {
@@ -1019,6 +1350,36 @@ func (tr *Firewall) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Firewall
+func (tr *Firewall) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Firewall using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Firewall) LateInitialize(attrs []byte) (bool, error) {
@@ -1103,6 +1464,36 @@ func (tr *FirewallPolicy) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this FirewallPolicy
+func (tr *FirewallPolicy) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this FirewallPolicy using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *FirewallPolicy) LateInitialize(attrs []byte) (bool, error) {
@@ -1187,6 +1578,36 @@ func (tr *FirewallPolicyAssociation) GetInitParameters() (map[string]any, error)
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this FirewallPolicyAssociation
+func (tr *FirewallPolicyAssociation) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this FirewallPolicyAssociation using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *FirewallPolicyAssociation) LateInitialize(attrs []byte) (bool, error) {
@@ -1271,6 +1692,36 @@ func (tr *FirewallPolicyRule) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this FirewallPolicyRule
+func (tr *FirewallPolicyRule) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this FirewallPolicyRule using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *FirewallPolicyRule) LateInitialize(attrs []byte) (bool, error) {
@@ -1355,6 +1806,36 @@ func (tr *ForwardingRule) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ForwardingRule
+func (tr *ForwardingRule) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ForwardingRule using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ForwardingRule) LateInitialize(attrs []byte) (bool, error) {
@@ -1439,6 +1920,36 @@ func (tr *GlobalAddress) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this GlobalAddress
+func (tr *GlobalAddress) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this GlobalAddress using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *GlobalAddress) LateInitialize(attrs []byte) (bool, error) {
@@ -1523,6 +2034,36 @@ func (tr *GlobalForwardingRule) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this GlobalForwardingRule
+func (tr *GlobalForwardingRule) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this GlobalForwardingRule using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *GlobalForwardingRule) LateInitialize(attrs []byte) (bool, error) {
@@ -1607,6 +2148,36 @@ func (tr *GlobalNetworkEndpoint) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this GlobalNetworkEndpoint
+func (tr *GlobalNetworkEndpoint) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this GlobalNetworkEndpoint using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *GlobalNetworkEndpoint) LateInitialize(attrs []byte) (bool, error) {
@@ -1691,14 +2262,44 @@ func (tr *GlobalNetworkEndpointGroup) GetInitParameters() (map[string]any, error
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
-// LateInitialize this GlobalNetworkEndpointGroup using its observed tfState.
-// returns True if there are any spec changes for the resource.
-func (tr *GlobalNetworkEndpointGroup) LateInitialize(attrs []byte) (bool, error) {
-	params := &GlobalNetworkEndpointGroupParameters{}
-	if err := json.TFParser.Unmarshal(attrs, params); err != nil {
-		return false, errors.Wrap(err, "failed to unmarshal Terraform state parameters for late-initialization")
+// GetInitParameters of this GlobalNetworkEndpointGroup
+func (tr *GlobalNetworkEndpointGroup) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
 	}
-	opts := []resource.GenericLateInitializerOption{resource.WithZeroValueJSONOmitEmptyFilter(resource.CNameWildcard)}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
+// LateInitialize this GlobalNetworkEndpointGroup using its observed tfState.
+// returns True if there are any spec changes for the resource.
+func (tr *GlobalNetworkEndpointGroup) LateInitialize(attrs []byte) (bool, error) {
+	params := &GlobalNetworkEndpointGroupParameters{}
+	if err := json.TFParser.Unmarshal(attrs, params); err != nil {
+		return false, errors.Wrap(err, "failed to unmarshal Terraform state parameters for late-initialization")
+	}
+	opts := []resource.GenericLateInitializerOption{resource.WithZeroValueJSONOmitEmptyFilter(resource.CNameWildcard)}
 
 	li := resource.NewGenericLateInitializer(opts...)
 	return li.LateInitialize(&tr.Spec.ForProvider, params)
@@ -1775,6 +2376,36 @@ func (tr *HaVPNGateway) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this HaVPNGateway
+func (tr *HaVPNGateway) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this HaVPNGateway using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *HaVPNGateway) LateInitialize(attrs []byte) (bool, error) {
@@ -1859,6 +2490,36 @@ func (tr *HealthCheck) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this HealthCheck
+func (tr *HealthCheck) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this HealthCheck using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *HealthCheck) LateInitialize(attrs []byte) (bool, error) {
@@ -1943,6 +2604,36 @@ func (tr *HTTPHealthCheck) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this HTTPHealthCheck
+func (tr *HTTPHealthCheck) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this HTTPHealthCheck using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *HTTPHealthCheck) LateInitialize(attrs []byte) (bool, error) {
@@ -2027,6 +2718,36 @@ func (tr *HTTPSHealthCheck) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this HTTPSHealthCheck
+func (tr *HTTPSHealthCheck) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this HTTPSHealthCheck using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *HTTPSHealthCheck) LateInitialize(attrs []byte) (bool, error) {
@@ -2111,6 +2832,36 @@ func (tr *Image) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Image
+func (tr *Image) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Image using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Image) LateInitialize(attrs []byte) (bool, error) {
@@ -2195,6 +2946,36 @@ func (tr *ImageIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ImageIAMMember
+func (tr *ImageIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ImageIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ImageIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -2279,6 +3060,36 @@ func (tr *Instance) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Instance
+func (tr *Instance) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Instance using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Instance) LateInitialize(attrs []byte) (bool, error) {
@@ -2363,6 +3174,36 @@ func (tr *InstanceFromTemplate) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this InstanceFromTemplate
+func (tr *InstanceFromTemplate) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this InstanceFromTemplate using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *InstanceFromTemplate) LateInitialize(attrs []byte) (bool, error) {
@@ -2447,6 +3288,36 @@ func (tr *InstanceGroup) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this InstanceGroup
+func (tr *InstanceGroup) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this InstanceGroup using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *InstanceGroup) LateInitialize(attrs []byte) (bool, error) {
@@ -2531,6 +3402,36 @@ func (tr *InstanceGroupManager) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this InstanceGroupManager
+func (tr *InstanceGroupManager) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this InstanceGroupManager using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *InstanceGroupManager) LateInitialize(attrs []byte) (bool, error) {
@@ -2615,6 +3516,36 @@ func (tr *InstanceGroupNamedPort) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this InstanceGroupNamedPort
+func (tr *InstanceGroupNamedPort) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this InstanceGroupNamedPort using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *InstanceGroupNamedPort) LateInitialize(attrs []byte) (bool, error) {
@@ -2699,6 +3630,36 @@ func (tr *InstanceIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this InstanceIAMMember
+func (tr *InstanceIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this InstanceIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *InstanceIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -2783,6 +3744,36 @@ func (tr *InstanceTemplate) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this InstanceTemplate
+func (tr *InstanceTemplate) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this InstanceTemplate using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *InstanceTemplate) LateInitialize(attrs []byte) (bool, error) {
@@ -2867,6 +3858,36 @@ func (tr *InterconnectAttachment) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this InterconnectAttachment
+func (tr *InterconnectAttachment) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this InterconnectAttachment using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *InterconnectAttachment) LateInitialize(attrs []byte) (bool, error) {
@@ -2951,6 +3972,36 @@ func (tr *ManagedSSLCertificate) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ManagedSSLCertificate
+func (tr *ManagedSSLCertificate) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ManagedSSLCertificate using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ManagedSSLCertificate) LateInitialize(attrs []byte) (bool, error) {
@@ -3035,6 +4086,36 @@ func (tr *Network) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Network
+func (tr *Network) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Network using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Network) LateInitialize(attrs []byte) (bool, error) {
@@ -3119,6 +4200,36 @@ func (tr *NetworkEndpoint) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this NetworkEndpoint
+func (tr *NetworkEndpoint) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this NetworkEndpoint using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *NetworkEndpoint) LateInitialize(attrs []byte) (bool, error) {
@@ -3203,6 +4314,36 @@ func (tr *NetworkEndpointGroup) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this NetworkEndpointGroup
+func (tr *NetworkEndpointGroup) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this NetworkEndpointGroup using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *NetworkEndpointGroup) LateInitialize(attrs []byte) (bool, error) {
@@ -3287,10 +4428,40 @@ func (tr *NetworkFirewallPolicy) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
-// LateInitialize this NetworkFirewallPolicy using its observed tfState.
-// returns True if there are any spec changes for the resource.
-func (tr *NetworkFirewallPolicy) LateInitialize(attrs []byte) (bool, error) {
-	params := &NetworkFirewallPolicyParameters{}
+// GetInitParameters of this NetworkFirewallPolicy
+func (tr *NetworkFirewallPolicy) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
+// LateInitialize this NetworkFirewallPolicy using its observed tfState.
+// returns True if there are any spec changes for the resource.
+func (tr *NetworkFirewallPolicy) LateInitialize(attrs []byte) (bool, error) {
+	params := &NetworkFirewallPolicyParameters{}
 	if err := json.TFParser.Unmarshal(attrs, params); err != nil {
 		return false, errors.Wrap(err, "failed to unmarshal Terraform state parameters for late-initialization")
 	}
@@ -3371,6 +4542,36 @@ func (tr *NetworkFirewallPolicyAssociation) GetInitParameters() (map[string]any,
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this NetworkFirewallPolicyAssociation
+func (tr *NetworkFirewallPolicyAssociation) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this NetworkFirewallPolicyAssociation using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *NetworkFirewallPolicyAssociation) LateInitialize(attrs []byte) (bool, error) {
@@ -3455,6 +4656,36 @@ func (tr *NetworkPeering) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this NetworkPeering
+func (tr *NetworkPeering) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this NetworkPeering using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *NetworkPeering) LateInitialize(attrs []byte) (bool, error) {
@@ -3539,6 +4770,36 @@ func (tr *NetworkPeeringRoutesConfig) GetInitParameters() (map[string]any, error
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this NetworkPeeringRoutesConfig
+func (tr *NetworkPeeringRoutesConfig) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this NetworkPeeringRoutesConfig using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *NetworkPeeringRoutesConfig) LateInitialize(attrs []byte) (bool, error) {
@@ -3623,6 +4884,36 @@ func (tr *NodeGroup) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this NodeGroup
+func (tr *NodeGroup) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this NodeGroup using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *NodeGroup) LateInitialize(attrs []byte) (bool, error) {
@@ -3707,6 +4998,36 @@ func (tr *NodeTemplate) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this NodeTemplate
+func (tr *NodeTemplate) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this NodeTemplate using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *NodeTemplate) LateInitialize(attrs []byte) (bool, error) {
@@ -3791,6 +5112,36 @@ func (tr *PacketMirroring) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this PacketMirroring
+func (tr *PacketMirroring) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this PacketMirroring using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *PacketMirroring) LateInitialize(attrs []byte) (bool, error) {
@@ -3875,6 +5226,36 @@ func (tr *PerInstanceConfig) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this PerInstanceConfig
+func (tr *PerInstanceConfig) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this PerInstanceConfig using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *PerInstanceConfig) LateInitialize(attrs []byte) (bool, error) {
@@ -3959,6 +5340,36 @@ func (tr *ProjectDefaultNetworkTier) GetInitParameters() (map[string]any, error)
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ProjectDefaultNetworkTier
+func (tr *ProjectDefaultNetworkTier) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ProjectDefaultNetworkTier using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ProjectDefaultNetworkTier) LateInitialize(attrs []byte) (bool, error) {
@@ -4043,6 +5454,36 @@ func (tr *ProjectMetadata) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ProjectMetadata
+func (tr *ProjectMetadata) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ProjectMetadata using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ProjectMetadata) LateInitialize(attrs []byte) (bool, error) {
@@ -4127,6 +5568,36 @@ func (tr *ProjectMetadataItem) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ProjectMetadataItem
+func (tr *ProjectMetadataItem) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ProjectMetadataItem using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ProjectMetadataItem) LateInitialize(attrs []byte) (bool, error) {
@@ -4211,6 +5682,36 @@ func (tr *RegionAutoscaler) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this RegionAutoscaler
+func (tr *RegionAutoscaler) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this RegionAutoscaler using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *RegionAutoscaler) LateInitialize(attrs []byte) (bool, error) {
@@ -4295,6 +5796,36 @@ func (tr *RegionBackendService) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this RegionBackendService
+func (tr *RegionBackendService) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this RegionBackendService using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *RegionBackendService) LateInitialize(attrs []byte) (bool, error) {
@@ -4379,6 +5910,36 @@ func (tr *RegionDisk) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this RegionDisk
+func (tr *RegionDisk) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this RegionDisk using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *RegionDisk) LateInitialize(attrs []byte) (bool, error) {
@@ -4463,6 +6024,36 @@ func (tr *RegionDiskIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this RegionDiskIAMMember
+func (tr *RegionDiskIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this RegionDiskIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *RegionDiskIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -4547,6 +6138,36 @@ func (tr *RegionDiskResourcePolicyAttachment) GetInitParameters() (map[string]an
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this RegionDiskResourcePolicyAttachment
+func (tr *RegionDiskResourcePolicyAttachment) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this RegionDiskResourcePolicyAttachment using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *RegionDiskResourcePolicyAttachment) LateInitialize(attrs []byte) (bool, error) {
@@ -4631,6 +6252,36 @@ func (tr *RegionHealthCheck) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this RegionHealthCheck
+func (tr *RegionHealthCheck) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this RegionHealthCheck using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *RegionHealthCheck) LateInitialize(attrs []byte) (bool, error) {
@@ -4715,6 +6366,36 @@ func (tr *RegionInstanceGroupManager) GetInitParameters() (map[string]any, error
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this RegionInstanceGroupManager
+func (tr *RegionInstanceGroupManager) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this RegionInstanceGroupManager using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *RegionInstanceGroupManager) LateInitialize(attrs []byte) (bool, error) {
@@ -4799,6 +6480,36 @@ func (tr *RegionNetworkEndpointGroup) GetInitParameters() (map[string]any, error
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this RegionNetworkEndpointGroup
+func (tr *RegionNetworkEndpointGroup) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this RegionNetworkEndpointGroup using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *RegionNetworkEndpointGroup) LateInitialize(attrs []byte) (bool, error) {
@@ -4883,6 +6594,36 @@ func (tr *RegionNetworkFirewallPolicy) GetInitParameters() (map[string]any, erro
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this RegionNetworkFirewallPolicy
+func (tr *RegionNetworkFirewallPolicy) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this RegionNetworkFirewallPolicy using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *RegionNetworkFirewallPolicy) LateInitialize(attrs []byte) (bool, error) {
@@ -4967,6 +6708,36 @@ func (tr *RegionNetworkFirewallPolicyAssociation) GetInitParameters() (map[strin
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this RegionNetworkFirewallPolicyAssociation
+func (tr *RegionNetworkFirewallPolicyAssociation) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this RegionNetworkFirewallPolicyAssociation using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *RegionNetworkFirewallPolicyAssociation) LateInitialize(attrs []byte) (bool, error) {
@@ -5051,6 +6822,36 @@ func (tr *RegionPerInstanceConfig) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this RegionPerInstanceConfig
+func (tr *RegionPerInstanceConfig) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this RegionPerInstanceConfig using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *RegionPerInstanceConfig) LateInitialize(attrs []byte) (bool, error) {
@@ -5135,6 +6936,36 @@ func (tr *RegionSSLCertificate) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this RegionSSLCertificate
+func (tr *RegionSSLCertificate) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this RegionSSLCertificate using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *RegionSSLCertificate) LateInitialize(attrs []byte) (bool, error) {
@@ -5219,6 +7050,36 @@ func (tr *RegionTargetHTTPProxy) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this RegionTargetHTTPProxy
+func (tr *RegionTargetHTTPProxy) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this RegionTargetHTTPProxy using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *RegionTargetHTTPProxy) LateInitialize(attrs []byte) (bool, error) {
@@ -5303,6 +7164,36 @@ func (tr *RegionTargetHTTPSProxy) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this RegionTargetHTTPSProxy
+func (tr *RegionTargetHTTPSProxy) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this RegionTargetHTTPSProxy using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *RegionTargetHTTPSProxy) LateInitialize(attrs []byte) (bool, error) {
@@ -5387,6 +7278,36 @@ func (tr *RegionURLMap) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this RegionURLMap
+func (tr *RegionURLMap) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this RegionURLMap using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *RegionURLMap) LateInitialize(attrs []byte) (bool, error) {
@@ -5471,6 +7392,36 @@ func (tr *Reservation) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Reservation
+func (tr *Reservation) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Reservation using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Reservation) LateInitialize(attrs []byte) (bool, error) {
@@ -5555,6 +7506,36 @@ func (tr *ResourcePolicy) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ResourcePolicy
+func (tr *ResourcePolicy) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ResourcePolicy using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ResourcePolicy) LateInitialize(attrs []byte) (bool, error) {
@@ -5639,6 +7620,36 @@ func (tr *Route) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Route
+func (tr *Route) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Route using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Route) LateInitialize(attrs []byte) (bool, error) {
@@ -5723,6 +7734,36 @@ func (tr *Router) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Router
+func (tr *Router) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Router using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Router) LateInitialize(attrs []byte) (bool, error) {
@@ -5807,6 +7848,36 @@ func (tr *RouterInterface) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this RouterInterface
+func (tr *RouterInterface) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this RouterInterface using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *RouterInterface) LateInitialize(attrs []byte) (bool, error) {
@@ -5891,6 +7962,36 @@ func (tr *RouterNAT) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this RouterNAT
+func (tr *RouterNAT) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this RouterNAT using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *RouterNAT) LateInitialize(attrs []byte) (bool, error) {
@@ -5975,6 +8076,36 @@ func (tr *RouterPeer) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this RouterPeer
+func (tr *RouterPeer) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this RouterPeer using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *RouterPeer) LateInitialize(attrs []byte) (bool, error) {
@@ -6046,17 +8177,47 @@ func (tr *SecurityPolicy) SetParameters(params map[string]any) error {
 	if err != nil {
 		return err
 	}
-	return json.TFParser.Unmarshal(p, &tr.Spec.ForProvider)
-}
+	return json.TFParser.Unmarshal(p, &tr.Spec.ForProvider)
+}
+
+// GetInitParameters of this SecurityPolicy
+func (tr *SecurityPolicy) GetInitParameters() (map[string]any, error) {
+	p, err := json.TFParser.Marshal(tr.Spec.InitProvider)
+	if err != nil {
+		return nil, err
+	}
+	base := map[string]any{}
+	return base, json.TFParser.Unmarshal(p, &base)
+}
+
+// GetInitParameters of this SecurityPolicy
+func (tr *SecurityPolicy) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
 
-// GetInitParameters of this SecurityPolicy
-func (tr *SecurityPolicy) GetInitParameters() (map[string]any, error) {
-	p, err := json.TFParser.Marshal(tr.Spec.InitProvider)
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
 	}
-	base := map[string]any{}
-	return base, json.TFParser.Unmarshal(p, &base)
+
+	return params, nil
 }
 
 // LateInitialize this SecurityPolicy using its observed tfState.
@@ -6143,6 +8304,36 @@ func (tr *ServiceAttachment) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ServiceAttachment
+func (tr *ServiceAttachment) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ServiceAttachment using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ServiceAttachment) LateInitialize(attrs []byte) (bool, error) {
@@ -6227,6 +8418,36 @@ func (tr *SharedVPCHostProject) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this SharedVPCHostProject
+func (tr *SharedVPCHostProject) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this SharedVPCHostProject using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *SharedVPCHostProject) LateInitialize(attrs []byte) (bool, error) {
@@ -6311,6 +8532,36 @@ func (tr *SharedVPCServiceProject) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this SharedVPCServiceProject
+func (tr *SharedVPCServiceProject) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this SharedVPCServiceProject using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *SharedVPCServiceProject) LateInitialize(attrs []byte) (bool, error) {
@@ -6395,6 +8646,36 @@ func (tr *Snapshot) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Snapshot
+func (tr *Snapshot) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Snapshot using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Snapshot) LateInitialize(attrs []byte) (bool, error) {
@@ -6479,6 +8760,36 @@ func (tr *SnapshotIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this SnapshotIAMMember
+func (tr *SnapshotIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this SnapshotIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *SnapshotIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -6563,6 +8874,36 @@ func (tr *SSLCertificate) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this SSLCertificate
+func (tr *SSLCertificate) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this SSLCertificate using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *SSLCertificate) LateInitialize(attrs []byte) (bool, error) {
@@ -6647,6 +8988,36 @@ func (tr *SSLPolicy) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this SSLPolicy
+func (tr *SSLPolicy) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this SSLPolicy using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *SSLPolicy) LateInitialize(attrs []byte) (bool, error) {
@@ -6731,6 +9102,36 @@ func (tr *Subnetwork) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Subnetwork
+func (tr *Subnetwork) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Subnetwork using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Subnetwork) LateInitialize(attrs []byte) (bool, error) {
@@ -6815,6 +9216,36 @@ func (tr *SubnetworkIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this SubnetworkIAMMember
+func (tr *SubnetworkIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this SubnetworkIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *SubnetworkIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -6899,6 +9330,36 @@ func (tr *TargetGRPCProxy) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this TargetGRPCProxy
+func (tr *TargetGRPCProxy) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this TargetGRPCProxy using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *TargetGRPCProxy) LateInitialize(attrs []byte) (bool, error) {
@@ -6983,6 +9444,36 @@ func (tr *TargetHTTPProxy) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this TargetHTTPProxy
+func (tr *TargetHTTPProxy) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this TargetHTTPProxy using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *TargetHTTPProxy) LateInitialize(attrs []byte) (bool, error) {
@@ -7067,6 +9558,36 @@ func (tr *TargetHTTPSProxy) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this TargetHTTPSProxy
+func (tr *TargetHTTPSProxy) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this TargetHTTPSProxy using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *TargetHTTPSProxy) LateInitialize(attrs []byte) (bool, error) {
@@ -7151,6 +9672,36 @@ func (tr *TargetInstance) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this TargetInstance
+func (tr *TargetInstance) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this TargetInstance using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *TargetInstance) LateInitialize(attrs []byte) (bool, error) {
@@ -7235,6 +9786,36 @@ func (tr *TargetPool) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this TargetPool
+func (tr *TargetPool) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this TargetPool using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *TargetPool) LateInitialize(attrs []byte) (bool, error) {
@@ -7319,6 +9900,36 @@ func (tr *TargetSSLProxy) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this TargetSSLProxy
+func (tr *TargetSSLProxy) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this TargetSSLProxy using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *TargetSSLProxy) LateInitialize(attrs []byte) (bool, error) {
@@ -7403,6 +10014,36 @@ func (tr *TargetTCPProxy) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this TargetTCPProxy
+func (tr *TargetTCPProxy) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this TargetTCPProxy using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *TargetTCPProxy) LateInitialize(attrs []byte) (bool, error) {
@@ -7487,6 +10128,36 @@ func (tr *URLMap) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this URLMap
+func (tr *URLMap) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this URLMap using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *URLMap) LateInitialize(attrs []byte) (bool, error) {
@@ -7571,6 +10242,36 @@ func (tr *VPNGateway) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this VPNGateway
+func (tr *VPNGateway) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this VPNGateway using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *VPNGateway) LateInitialize(attrs []byte) (bool, error) {
@@ -7655,6 +10356,36 @@ func (tr *VPNTunnel) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this VPNTunnel
+func (tr *VPNTunnel) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this VPNTunnel using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *VPNTunnel) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/compute/v1beta1/zz_globalforwardingrule_types.go b/apis/compute/v1beta1/zz_globalforwardingrule_types.go
index 1cb79d8ff..ad84038ae 100755
--- a/apis/compute/v1beta1/zz_globalforwardingrule_types.go
+++ b/apis/compute/v1beta1/zz_globalforwardingrule_types.go
@@ -113,6 +113,7 @@ type GlobalForwardingRuleInitParameters struct {
 	IPVersion *string `json:"ipVersion,omitempty" tf:"ip_version,omitempty"`
 
 	// Labels to apply to this forwarding rule.  A list of key->value pairs.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Specifies the forwarding rule type.
@@ -188,6 +189,7 @@ type GlobalForwardingRuleObservation struct {
 	LabelFingerprint *string `json:"labelFingerprint,omitempty" tf:"label_fingerprint,omitempty"`
 
 	// Labels to apply to this forwarding rule.  A list of key->value pairs.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Specifies the forwarding rule type.
@@ -298,6 +300,7 @@ type GlobalForwardingRuleParameters struct {
 
 	// Labels to apply to this forwarding rule.  A list of key->value pairs.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Specifies the forwarding rule type.
diff --git a/apis/compute/v1beta1/zz_image_types.go b/apis/compute/v1beta1/zz_image_types.go
index dd921c4fa..e97beadb8 100755
--- a/apis/compute/v1beta1/zz_image_types.go
+++ b/apis/compute/v1beta1/zz_image_types.go
@@ -118,6 +118,7 @@ type ImageInitParameters struct {
 	ImageEncryptionKey []ImageEncryptionKeyInitParameters `json:"imageEncryptionKey,omitempty" tf:"image_encryption_key,omitempty"`
 
 	// Labels to apply to this Image.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Any applicable license URI.
@@ -193,6 +194,7 @@ type ImageObservation struct {
 	LabelFingerprint *string `json:"labelFingerprint,omitempty" tf:"label_fingerprint,omitempty"`
 
 	// Labels to apply to this Image.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Any applicable license URI.
@@ -263,6 +265,7 @@ type ImageParameters struct {
 
 	// Labels to apply to this Image.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Any applicable license URI.
diff --git a/apis/compute/v1beta1/zz_instance_types.go b/apis/compute/v1beta1/zz_instance_types.go
index 21b60f37a..b8cd72e74 100755
--- a/apis/compute/v1beta1/zz_instance_types.go
+++ b/apis/compute/v1beta1/zz_instance_types.go
@@ -397,6 +397,7 @@ type InitializeParamsInitParameters struct {
 	Labels map[string]string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// A tag is a key-value pair that can be attached to a Google Cloud resource. You can use tags to conditionally allow or deny policies based on whether a resource has a specific tag. This value is not returned by the API.
+	// +mapType=granular
 	ResourceManagerTags map[string]*string `json:"resourceManagerTags,omitempty" tf:"resource_manager_tags,omitempty"`
 
 	// The size of the image in gigabytes. If not specified, it
@@ -424,6 +425,7 @@ type InitializeParamsObservation struct {
 	Labels map[string]string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// A tag is a key-value pair that can be attached to a Google Cloud resource. You can use tags to conditionally allow or deny policies based on whether a resource has a specific tag. This value is not returned by the API.
+	// +mapType=granular
 	ResourceManagerTags map[string]*string `json:"resourceManagerTags,omitempty" tf:"resource_manager_tags,omitempty"`
 
 	// The size of the image in gigabytes. If not specified, it
@@ -463,6 +465,7 @@ type InitializeParamsParameters struct {
 
 	// A tag is a key-value pair that can be attached to a Google Cloud resource. You can use tags to conditionally allow or deny policies based on whether a resource has a specific tag. This value is not returned by the API.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	ResourceManagerTags map[string]*string `json:"resourceManagerTags,omitempty" tf:"resource_manager_tags,omitempty"`
 
 	// The size of the image in gigabytes. If not specified, it
@@ -607,6 +610,7 @@ type InstanceInitParameters struct {
 	Hostname *string `json:"hostname,omitempty" tf:"hostname,omitempty"`
 
 	// A map of key/value label pairs to assign to the instance.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The machine type to create.
@@ -616,6 +620,7 @@ type InstanceInitParameters struct {
 	// within the instance. Ssh keys attached in the Cloud Console will be removed.
 	// Add them to your config in order to keep them attached to your instance. A
 	// list of default metadata values (e.g. ssh-keys) can be found here
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// An alternative to using the
@@ -676,6 +681,7 @@ type InstanceInitParameters struct {
 	ShieldedInstanceConfig []ShieldedInstanceConfigInitParameters `json:"shieldedInstanceConfig,omitempty" tf:"shielded_instance_config,omitempty"`
 
 	// A list of network tags to attach to the instance.
+	// +listType=set
 	Tags []*string `json:"tags,omitempty" tf:"tags,omitempty"`
 }
 
@@ -747,6 +753,7 @@ type InstanceObservation struct {
 	LabelFingerprint *string `json:"labelFingerprint,omitempty" tf:"label_fingerprint,omitempty"`
 
 	// A map of key/value label pairs to assign to the instance.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The machine type to create.
@@ -756,6 +763,7 @@ type InstanceObservation struct {
 	// within the instance. Ssh keys attached in the Cloud Console will be removed.
 	// Add them to your config in order to keep them attached to your instance. A
 	// list of default metadata values (e.g. ssh-keys) can be found here
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// The unique fingerprint of the metadata.
@@ -822,6 +830,7 @@ type InstanceObservation struct {
 	ShieldedInstanceConfig []ShieldedInstanceConfigObservation `json:"shieldedInstanceConfig,omitempty" tf:"shielded_instance_config,omitempty"`
 
 	// A list of network tags to attach to the instance.
+	// +listType=set
 	Tags []*string `json:"tags,omitempty" tf:"tags,omitempty"`
 
 	// The unique fingerprint of the tags.
@@ -897,6 +906,7 @@ type InstanceParameters struct {
 
 	// A map of key/value label pairs to assign to the instance.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The machine type to create.
@@ -908,6 +918,7 @@ type InstanceParameters struct {
 	// Add them to your config in order to keep them attached to your instance. A
 	// list of default metadata values (e.g. ssh-keys) can be found here
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// An alternative to using the
@@ -981,6 +992,7 @@ type InstanceParameters struct {
 
 	// A list of network tags to attach to the instance.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Tags []*string `json:"tags,omitempty" tf:"tags,omitempty"`
 
 	// The zone that the machine should be created in. If it is not provided, the provider zone is used.
@@ -1247,6 +1259,7 @@ type NodeAffinitiesInitParameters struct {
 	Operator *string `json:"operator,omitempty" tf:"operator,omitempty"`
 
 	// Corresponds to the label values of a reservation resource.
+	// +listType=set
 	Values []*string `json:"values,omitempty" tf:"values,omitempty"`
 }
 
@@ -1260,6 +1273,7 @@ type NodeAffinitiesObservation struct {
 	Operator *string `json:"operator,omitempty" tf:"operator,omitempty"`
 
 	// Corresponds to the label values of a reservation resource.
+	// +listType=set
 	Values []*string `json:"values,omitempty" tf:"values,omitempty"`
 }
 
@@ -1276,18 +1290,21 @@ type NodeAffinitiesParameters struct {
 
 	// Corresponds to the label values of a reservation resource.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Values []*string `json:"values" tf:"values,omitempty"`
 }
 
 type ParamsInitParameters struct {
 
 	// A tag is a key-value pair that can be attached to a Google Cloud resource. You can use tags to conditionally allow or deny policies based on whether a resource has a specific tag. This value is not returned by the API.
+	// +mapType=granular
 	ResourceManagerTags map[string]*string `json:"resourceManagerTags,omitempty" tf:"resource_manager_tags,omitempty"`
 }
 
 type ParamsObservation struct {
 
 	// A tag is a key-value pair that can be attached to a Google Cloud resource. You can use tags to conditionally allow or deny policies based on whether a resource has a specific tag. This value is not returned by the API.
+	// +mapType=granular
 	ResourceManagerTags map[string]*string `json:"resourceManagerTags,omitempty" tf:"resource_manager_tags,omitempty"`
 }
 
@@ -1295,6 +1312,7 @@ type ParamsParameters struct {
 
 	// A tag is a key-value pair that can be attached to a Google Cloud resource. You can use tags to conditionally allow or deny policies based on whether a resource has a specific tag. This value is not returned by the API.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	ResourceManagerTags map[string]*string `json:"resourceManagerTags,omitempty" tf:"resource_manager_tags,omitempty"`
 }
 
@@ -1499,6 +1517,7 @@ type ServiceAccountInitParameters struct {
 	// short names are supported. To allow full access to all Cloud APIs, use the
 	// cloud-platform scope. See a complete list of scopes here.
 	// Note: allow_stopping_for_update must be set to true or your instance must have a desired_status of TERMINATED in order to update this field.
+	// +listType=set
 	Scopes []*string `json:"scopes,omitempty" tf:"scopes,omitempty"`
 }
 
@@ -1512,6 +1531,7 @@ type ServiceAccountObservation struct {
 	// short names are supported. To allow full access to all Cloud APIs, use the
 	// cloud-platform scope. See a complete list of scopes here.
 	// Note: allow_stopping_for_update must be set to true or your instance must have a desired_status of TERMINATED in order to update this field.
+	// +listType=set
 	Scopes []*string `json:"scopes,omitempty" tf:"scopes,omitempty"`
 }
 
@@ -1537,6 +1557,7 @@ type ServiceAccountParameters struct {
 	// cloud-platform scope. See a complete list of scopes here.
 	// Note: allow_stopping_for_update must be set to true or your instance must have a desired_status of TERMINATED in order to update this field.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Scopes []*string `json:"scopes" tf:"scopes,omitempty"`
 }
 
diff --git a/apis/compute/v1beta1/zz_instancefromtemplate_types.go b/apis/compute/v1beta1/zz_instancefromtemplate_types.go
index 58fd0731b..fafaa8893 100755
--- a/apis/compute/v1beta1/zz_instancefromtemplate_types.go
+++ b/apis/compute/v1beta1/zz_instancefromtemplate_types.go
@@ -34,6 +34,7 @@ type BootDiskInitializeParamsInitParameters struct {
 
 	Labels map[string]string `json:"labels,omitempty" tf:"labels,omitempty"`
 
+	// +mapType=granular
 	ResourceManagerTags map[string]*string `json:"resourceManagerTags,omitempty" tf:"resource_manager_tags,omitempty"`
 
 	Size *float64 `json:"size,omitempty" tf:"size,omitempty"`
@@ -46,6 +47,7 @@ type BootDiskInitializeParamsObservation struct {
 
 	Labels map[string]string `json:"labels,omitempty" tf:"labels,omitempty"`
 
+	// +mapType=granular
 	ResourceManagerTags map[string]*string `json:"resourceManagerTags,omitempty" tf:"resource_manager_tags,omitempty"`
 
 	Size *float64 `json:"size,omitempty" tf:"size,omitempty"`
@@ -62,6 +64,7 @@ type BootDiskInitializeParamsParameters struct {
 	Labels map[string]string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	ResourceManagerTags map[string]*string `json:"resourceManagerTags,omitempty" tf:"resource_manager_tags,omitempty"`
 
 	// +kubebuilder:validation:Optional
@@ -284,6 +287,7 @@ type InstanceFromTemplateInitParameters struct {
 	// Changing this forces a new resource to be created.
 	Hostname *string `json:"hostname,omitempty" tf:"hostname,omitempty"`
 
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	MachineType *string `json:"machineType,omitempty" tf:"machine_type,omitempty"`
@@ -318,6 +322,7 @@ type InstanceFromTemplateInitParameters struct {
 
 	ShieldedInstanceConfig []InstanceFromTemplateShieldedInstanceConfigInitParameters `json:"shieldedInstanceConfig,omitempty" tf:"shielded_instance_config,omitempty"`
 
+	// +listType=set
 	Tags []*string `json:"tags,omitempty" tf:"tags,omitempty"`
 
 	// The zone that the machine should be created in. If not
@@ -474,6 +479,7 @@ type InstanceFromTemplateObservation struct {
 
 	LabelFingerprint *string `json:"labelFingerprint,omitempty" tf:"label_fingerprint,omitempty"`
 
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	MachineType *string `json:"machineType,omitempty" tf:"machine_type,omitempty"`
@@ -517,6 +523,7 @@ type InstanceFromTemplateObservation struct {
 	// instance templates through their unique id (self_link_unique attribute).
 	SourceInstanceTemplate *string `json:"sourceInstanceTemplate,omitempty" tf:"source_instance_template,omitempty"`
 
+	// +listType=set
 	Tags []*string `json:"tags,omitempty" tf:"tags,omitempty"`
 
 	TagsFingerprint *string `json:"tagsFingerprint,omitempty" tf:"tags_fingerprint,omitempty"`
@@ -568,6 +575,7 @@ type InstanceFromTemplateParameters struct {
 	Hostname *string `json:"hostname,omitempty" tf:"hostname,omitempty"`
 
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// +kubebuilder:validation:Optional
@@ -634,6 +642,7 @@ type InstanceFromTemplateParameters struct {
 	SourceInstanceTemplateSelector *v1.Selector `json:"sourceInstanceTemplateSelector,omitempty" tf:"-"`
 
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Tags []*string `json:"tags,omitempty" tf:"tags,omitempty"`
 
 	// The zone that the machine should be created in. If not
@@ -643,16 +652,21 @@ type InstanceFromTemplateParameters struct {
 }
 
 type InstanceFromTemplateParamsInitParameters struct {
+
+	// +mapType=granular
 	ResourceManagerTags map[string]*string `json:"resourceManagerTags,omitempty" tf:"resource_manager_tags,omitempty"`
 }
 
 type InstanceFromTemplateParamsObservation struct {
+
+	// +mapType=granular
 	ResourceManagerTags map[string]*string `json:"resourceManagerTags,omitempty" tf:"resource_manager_tags,omitempty"`
 }
 
 type InstanceFromTemplateParamsParameters struct {
 
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	ResourceManagerTags map[string]*string `json:"resourceManagerTags,omitempty" tf:"resource_manager_tags,omitempty"`
 }
 
@@ -764,12 +778,14 @@ type InstanceFromTemplateScratchDiskParameters struct {
 type InstanceFromTemplateServiceAccountInitParameters struct {
 	Email *string `json:"email,omitempty" tf:"email"`
 
+	// +listType=set
 	Scopes []*string `json:"scopes,omitempty" tf:"scopes"`
 }
 
 type InstanceFromTemplateServiceAccountObservation struct {
 	Email *string `json:"email,omitempty" tf:"email,omitempty"`
 
+	// +listType=set
 	Scopes []*string `json:"scopes,omitempty" tf:"scopes,omitempty"`
 }
 
@@ -779,6 +795,7 @@ type InstanceFromTemplateServiceAccountParameters struct {
 	Email *string `json:"email,omitempty" tf:"email"`
 
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Scopes []*string `json:"scopes,omitempty" tf:"scopes"`
 }
 
@@ -972,6 +989,7 @@ type SchedulingNodeAffinitiesInitParameters struct {
 
 	Operator *string `json:"operator,omitempty" tf:"operator,omitempty"`
 
+	// +listType=set
 	Values []*string `json:"values,omitempty" tf:"values,omitempty"`
 }
 
@@ -980,6 +998,7 @@ type SchedulingNodeAffinitiesObservation struct {
 
 	Operator *string `json:"operator,omitempty" tf:"operator,omitempty"`
 
+	// +listType=set
 	Values []*string `json:"values,omitempty" tf:"values,omitempty"`
 }
 
@@ -992,6 +1011,7 @@ type SchedulingNodeAffinitiesParameters struct {
 	Operator *string `json:"operator" tf:"operator,omitempty"`
 
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Values []*string `json:"values" tf:"values,omitempty"`
 }
 
diff --git a/apis/compute/v1beta1/zz_instancegroup_types.go b/apis/compute/v1beta1/zz_instancegroup_types.go
index 357741df6..07a054264 100755
--- a/apis/compute/v1beta1/zz_instancegroup_types.go
+++ b/apis/compute/v1beta1/zz_instancegroup_types.go
@@ -37,6 +37,7 @@ type InstanceGroupInitParameters struct {
 
 	// The list of instances in the group, in self_link format.
 	// When adding instances they must all be in the same network and zone as the instance group.
+	// +listType=set
 	Instances []*string `json:"instances,omitempty" tf:"instances,omitempty"`
 
 	// The named port configuration. See the section below
@@ -59,6 +60,7 @@ type InstanceGroupObservation struct {
 
 	// The list of instances in the group, in self_link format.
 	// When adding instances they must all be in the same network and zone as the instance group.
+	// +listType=set
 	Instances []*string `json:"instances,omitempty" tf:"instances,omitempty"`
 
 	// The named port configuration. See the section below
@@ -95,6 +97,7 @@ type InstanceGroupParameters struct {
 	// The list of instances in the group, in self_link format.
 	// When adding instances they must all be in the same network and zone as the instance group.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Instances []*string `json:"instances,omitempty" tf:"instances,omitempty"`
 
 	// The named port configuration. See the section below
diff --git a/apis/compute/v1beta1/zz_instancegroupmanager_types.go b/apis/compute/v1beta1/zz_instancegroupmanager_types.go
index 729bacb40..6815972fe 100755
--- a/apis/compute/v1beta1/zz_instancegroupmanager_types.go
+++ b/apis/compute/v1beta1/zz_instancegroupmanager_types.go
@@ -219,6 +219,7 @@ type InstanceGroupManagerObservation struct {
 	// The full URL of all target pools to which new
 	// instances in the group are added. Updating the target pools attribute does
 	// not affect existing instances.
+	// +listType=set
 	TargetPools []*string `json:"targetPools,omitempty" tf:"target_pools,omitempty"`
 
 	// The target number of running instances for this managed
@@ -302,6 +303,7 @@ type InstanceGroupManagerParameters struct {
 	// +crossplane:generate:reference:type=TargetPool
 	// +crossplane:generate:reference:extractor=github.com/upbound/provider-gcp/config/common.SelfLinkExtractor()
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	TargetPools []*string `json:"targetPools,omitempty" tf:"target_pools,omitempty"`
 
 	// References to TargetPool to populate targetPools.
diff --git a/apis/compute/v1beta1/zz_instancetemplate_types.go b/apis/compute/v1beta1/zz_instancetemplate_types.go
index 6e735f7c0..0409e258d 100755
--- a/apis/compute/v1beta1/zz_instancetemplate_types.go
+++ b/apis/compute/v1beta1/zz_instancetemplate_types.go
@@ -223,6 +223,7 @@ type InstanceTemplateDiskInitParameters struct {
 
 	// A set of ket/value label pairs to assign to disk created from
 	// this template
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The mode in which to attach this disk, either READ_WRITE
@@ -299,6 +300,7 @@ type InstanceTemplateDiskObservation struct {
 
 	// A set of ket/value label pairs to assign to disk created from
 	// this template
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The mode in which to attach this disk, either READ_WRITE
@@ -389,6 +391,7 @@ type InstanceTemplateDiskParameters struct {
 	// A set of ket/value label pairs to assign to disk created from
 	// this template
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The mode in which to attach this disk, either READ_WRITE
@@ -507,6 +510,7 @@ type InstanceTemplateInitParameters struct {
 
 	// A set of key/value label pairs to assign to instances
 	// created from this template.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The machine type to create.
@@ -573,6 +577,7 @@ type InstanceTemplateInitParameters struct {
 	ShieldedInstanceConfig []InstanceTemplateShieldedInstanceConfigInitParameters `json:"shieldedInstanceConfig,omitempty" tf:"shielded_instance_config,omitempty"`
 
 	// Tags to attach to the instance.
+	// +listType=set
 	Tags []*string `json:"tags,omitempty" tf:"tags,omitempty"`
 }
 
@@ -901,6 +906,7 @@ type InstanceTemplateObservation struct {
 
 	// A set of key/value label pairs to assign to instances
 	// created from this template.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The machine type to create.
@@ -977,6 +983,7 @@ type InstanceTemplateObservation struct {
 	ShieldedInstanceConfig []InstanceTemplateShieldedInstanceConfigObservation `json:"shieldedInstanceConfig,omitempty" tf:"shielded_instance_config,omitempty"`
 
 	// Tags to attach to the instance.
+	// +listType=set
 	Tags []*string `json:"tags,omitempty" tf:"tags,omitempty"`
 
 	// The unique fingerprint of the tags.
@@ -1020,6 +1027,7 @@ type InstanceTemplateParameters struct {
 	// A set of key/value label pairs to assign to instances
 	// created from this template.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The machine type to create.
@@ -1102,6 +1110,7 @@ type InstanceTemplateParameters struct {
 
 	// Tags to attach to the instance.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Tags []*string `json:"tags,omitempty" tf:"tags,omitempty"`
 }
 
@@ -1259,6 +1268,7 @@ type InstanceTemplateSchedulingNodeAffinitiesInitParameters struct {
 	Operator *string `json:"operator,omitempty" tf:"operator,omitempty"`
 
 	// Corresponds to the label values of a reservation resource.
+	// +listType=set
 	Values []*string `json:"values,omitempty" tf:"values,omitempty"`
 }
 
@@ -1272,6 +1282,7 @@ type InstanceTemplateSchedulingNodeAffinitiesObservation struct {
 	Operator *string `json:"operator,omitempty" tf:"operator,omitempty"`
 
 	// Corresponds to the label values of a reservation resource.
+	// +listType=set
 	Values []*string `json:"values,omitempty" tf:"values,omitempty"`
 }
 
@@ -1288,6 +1299,7 @@ type InstanceTemplateSchedulingNodeAffinitiesParameters struct {
 
 	// Corresponds to the label values of a reservation resource.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Values []*string `json:"values" tf:"values,omitempty"`
 }
 
@@ -1382,6 +1394,7 @@ type InstanceTemplateServiceAccountInitParameters struct {
 	// A list of service scopes. Both OAuth2 URLs and gcloud
 	// short names are supported. To allow full access to all Cloud APIs, use the
 	// cloud-platform scope. See a complete list of scopes here.
+	// +listType=set
 	Scopes []*string `json:"scopes,omitempty" tf:"scopes,omitempty"`
 }
 
@@ -1394,6 +1407,7 @@ type InstanceTemplateServiceAccountObservation struct {
 	// A list of service scopes. Both OAuth2 URLs and gcloud
 	// short names are supported. To allow full access to all Cloud APIs, use the
 	// cloud-platform scope. See a complete list of scopes here.
+	// +listType=set
 	Scopes []*string `json:"scopes,omitempty" tf:"scopes,omitempty"`
 }
 
@@ -1418,6 +1432,7 @@ type InstanceTemplateServiceAccountParameters struct {
 	// short names are supported. To allow full access to all Cloud APIs, use the
 	// cloud-platform scope. See a complete list of scopes here.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Scopes []*string `json:"scopes" tf:"scopes,omitempty"`
 }
 
diff --git a/apis/compute/v1beta1/zz_nodetemplate_types.go b/apis/compute/v1beta1/zz_nodetemplate_types.go
index 381794a00..7564b5dd8 100755
--- a/apis/compute/v1beta1/zz_nodetemplate_types.go
+++ b/apis/compute/v1beta1/zz_nodetemplate_types.go
@@ -41,6 +41,7 @@ type NodeTemplateInitParameters struct {
 
 	// Labels to use for node affinity, which will be used in
 	// instance scheduling.
+	// +mapType=granular
 	NodeAffinityLabels map[string]*string `json:"nodeAffinityLabels,omitempty" tf:"node_affinity_labels,omitempty"`
 
 	// Node type to use for nodes group that are created from this template.
@@ -82,6 +83,7 @@ type NodeTemplateObservation struct {
 
 	// Labels to use for node affinity, which will be used in
 	// instance scheduling.
+	// +mapType=granular
 	NodeAffinityLabels map[string]*string `json:"nodeAffinityLabels,omitempty" tf:"node_affinity_labels,omitempty"`
 
 	// Node type to use for nodes group that are created from this template.
@@ -127,6 +129,7 @@ type NodeTemplateParameters struct {
 	// Labels to use for node affinity, which will be used in
 	// instance scheduling.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	NodeAffinityLabels map[string]*string `json:"nodeAffinityLabels,omitempty" tf:"node_affinity_labels,omitempty"`
 
 	// Node type to use for nodes group that are created from this template.
diff --git a/apis/compute/v1beta1/zz_perinstanceconfig_types.go b/apis/compute/v1beta1/zz_perinstanceconfig_types.go
index 8fc877e8f..71f35c7b2 100755
--- a/apis/compute/v1beta1/zz_perinstanceconfig_types.go
+++ b/apis/compute/v1beta1/zz_perinstanceconfig_types.go
@@ -241,6 +241,7 @@ type PreservedStateInitParameters struct {
 	Disk []PreservedStateDiskInitParameters `json:"disk,omitempty" tf:"disk,omitempty"`
 
 	// Preserved metadata defined for this instance. This is a list of key->value pairs.
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 }
 
@@ -251,6 +252,7 @@ type PreservedStateObservation struct {
 	Disk []PreservedStateDiskObservation `json:"disk,omitempty" tf:"disk,omitempty"`
 
 	// Preserved metadata defined for this instance. This is a list of key->value pairs.
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 }
 
@@ -263,6 +265,7 @@ type PreservedStateParameters struct {
 
 	// Preserved metadata defined for this instance. This is a list of key->value pairs.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 }
 
diff --git a/apis/compute/v1beta1/zz_projectmetadata_types.go b/apis/compute/v1beta1/zz_projectmetadata_types.go
index aafd887b3..11ad13983 100755
--- a/apis/compute/v1beta1/zz_projectmetadata_types.go
+++ b/apis/compute/v1beta1/zz_projectmetadata_types.go
@@ -32,6 +32,7 @@ import (
 type ProjectMetadataInitParameters struct {
 
 	// A series of key value pairs.
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// The ID of the project in which the resource belongs. If it
@@ -45,6 +46,7 @@ type ProjectMetadataObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// A series of key value pairs.
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// The ID of the project in which the resource belongs. If it
@@ -56,6 +58,7 @@ type ProjectMetadataParameters struct {
 
 	// A series of key value pairs.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// The ID of the project in which the resource belongs. If it
diff --git a/apis/compute/v1beta1/zz_regionbackendservice_types.go b/apis/compute/v1beta1/zz_regionbackendservice_types.go
index af83f4578..c0ac6139a 100755
--- a/apis/compute/v1beta1/zz_regionbackendservice_types.go
+++ b/apis/compute/v1beta1/zz_regionbackendservice_types.go
@@ -627,6 +627,7 @@ type RegionBackendServiceCdnPolicyCacheKeyPolicyInitParameters struct {
 	// query_string_whitelist or query_string_blacklist, not both.
 	// '&' and '=' will be percent encoded and not treated as
 	// delimiters.
+	// +listType=set
 	QueryStringBlacklist []*string `json:"queryStringBlacklist,omitempty" tf:"query_string_blacklist,omitempty"`
 
 	// Names of query string parameters to include in cache keys.
@@ -634,6 +635,7 @@ type RegionBackendServiceCdnPolicyCacheKeyPolicyInitParameters struct {
 	// query_string_whitelist or query_string_blacklist, not both.
 	// '&' and '=' will be percent encoded and not treated as
 	// delimiters.
+	// +listType=set
 	QueryStringWhitelist []*string `json:"queryStringWhitelist,omitempty" tf:"query_string_whitelist,omitempty"`
 }
 
@@ -661,6 +663,7 @@ type RegionBackendServiceCdnPolicyCacheKeyPolicyObservation struct {
 	// query_string_whitelist or query_string_blacklist, not both.
 	// '&' and '=' will be percent encoded and not treated as
 	// delimiters.
+	// +listType=set
 	QueryStringBlacklist []*string `json:"queryStringBlacklist,omitempty" tf:"query_string_blacklist,omitempty"`
 
 	// Names of query string parameters to include in cache keys.
@@ -668,6 +671,7 @@ type RegionBackendServiceCdnPolicyCacheKeyPolicyObservation struct {
 	// query_string_whitelist or query_string_blacklist, not both.
 	// '&' and '=' will be percent encoded and not treated as
 	// delimiters.
+	// +listType=set
 	QueryStringWhitelist []*string `json:"queryStringWhitelist,omitempty" tf:"query_string_whitelist,omitempty"`
 }
 
@@ -700,6 +704,7 @@ type RegionBackendServiceCdnPolicyCacheKeyPolicyParameters struct {
 	// '&' and '=' will be percent encoded and not treated as
 	// delimiters.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	QueryStringBlacklist []*string `json:"queryStringBlacklist,omitempty" tf:"query_string_blacklist,omitempty"`
 
 	// Names of query string parameters to include in cache keys.
@@ -708,6 +713,7 @@ type RegionBackendServiceCdnPolicyCacheKeyPolicyParameters struct {
 	// '&' and '=' will be percent encoded and not treated as
 	// delimiters.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	QueryStringWhitelist []*string `json:"queryStringWhitelist,omitempty" tf:"query_string_whitelist,omitempty"`
 }
 
@@ -1241,6 +1247,7 @@ type RegionBackendServiceObservation struct {
 	// check can be specified.
 	// A health check must be specified unless the backend service uses an internet
 	// or serverless NEG as a backend.
+	// +listType=set
 	HealthChecks []*string `json:"healthChecks,omitempty" tf:"health_checks,omitempty"`
 
 	// an identifier for the resource with format projects/{{project}}/regions/{{region}}/backendServices/{{name}}
@@ -1571,6 +1578,7 @@ type RegionBackendServiceParameters struct {
 	// +crossplane:generate:reference:type=RegionHealthCheck
 	// +crossplane:generate:reference:extractor=github.com/upbound/provider-gcp/config/common.SelfLinkExtractor()
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	HealthChecks []*string `json:"healthChecks,omitempty" tf:"health_checks,omitempty"`
 
 	// References to RegionHealthCheck to populate healthChecks.
diff --git a/apis/compute/v1beta1/zz_regiondisk_types.go b/apis/compute/v1beta1/zz_regiondisk_types.go
index 54e15541f..8a04658cd 100755
--- a/apis/compute/v1beta1/zz_regiondisk_types.go
+++ b/apis/compute/v1beta1/zz_regiondisk_types.go
@@ -135,6 +135,7 @@ type RegionDiskInitParameters struct {
 	GuestOsFeatures []RegionDiskGuestOsFeaturesInitParameters `json:"guestOsFeatures,omitempty" tf:"guest_os_features,omitempty"`
 
 	// Labels to apply to this disk.  A list of key->value pairs.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Any applicable license URI.
@@ -216,6 +217,7 @@ type RegionDiskObservation struct {
 	LabelFingerprint *string `json:"labelFingerprint,omitempty" tf:"label_fingerprint,omitempty"`
 
 	// Labels to apply to this disk.  A list of key->value pairs.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Last attach timestamp in RFC3339 text format.
@@ -326,6 +328,7 @@ type RegionDiskParameters struct {
 
 	// Labels to apply to this disk.  A list of key->value pairs.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Any applicable license URI.
diff --git a/apis/compute/v1beta1/zz_regioninstancegroupmanager_types.go b/apis/compute/v1beta1/zz_regioninstancegroupmanager_types.go
index 915715b1d..022522e4e 100755
--- a/apis/compute/v1beta1/zz_regioninstancegroupmanager_types.go
+++ b/apis/compute/v1beta1/zz_regioninstancegroupmanager_types.go
@@ -91,6 +91,7 @@ type RegionInstanceGroupManagerInitParameters struct {
 
 	// The distribution policy for this managed instance
 	// group. You can specify one or more values. For more information, see the official documentation.
+	// +listType=set
 	DistributionPolicyZones []*string `json:"distributionPolicyZones,omitempty" tf:"distribution_policy_zones,omitempty"`
 
 	InstanceLifecyclePolicy []RegionInstanceGroupManagerInstanceLifecyclePolicyInitParameters `json:"instanceLifecyclePolicy,omitempty" tf:"instance_lifecycle_policy,omitempty"`
@@ -218,6 +219,7 @@ type RegionInstanceGroupManagerObservation struct {
 
 	// The distribution policy for this managed instance
 	// group. You can specify one or more values. For more information, see the official documentation.
+	// +listType=set
 	DistributionPolicyZones []*string `json:"distributionPolicyZones,omitempty" tf:"distribution_policy_zones,omitempty"`
 
 	// The fingerprint of the instance group manager.
@@ -267,6 +269,7 @@ type RegionInstanceGroupManagerObservation struct {
 	// The full URL of all target pools to which new
 	// instances in the group are added. Updating the target pools attribute does
 	// not affect existing instances.
+	// +listType=set
 	TargetPools []*string `json:"targetPools,omitempty" tf:"target_pools,omitempty"`
 
 	// The target number of running instances for this managed
@@ -321,6 +324,7 @@ type RegionInstanceGroupManagerParameters struct {
 	// The distribution policy for this managed instance
 	// group. You can specify one or more values. For more information, see the official documentation.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	DistributionPolicyZones []*string `json:"distributionPolicyZones,omitempty" tf:"distribution_policy_zones,omitempty"`
 
 	// +kubebuilder:validation:Optional
@@ -366,6 +370,7 @@ type RegionInstanceGroupManagerParameters struct {
 	// +crossplane:generate:reference:type=TargetPool
 	// +crossplane:generate:reference:extractor=github.com/upbound/provider-gcp/config/common.SelfLinkExtractor()
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	TargetPools []*string `json:"targetPools,omitempty" tf:"target_pools,omitempty"`
 
 	// References to TargetPool to populate targetPools.
diff --git a/apis/compute/v1beta1/zz_regionperinstanceconfig_types.go b/apis/compute/v1beta1/zz_regionperinstanceconfig_types.go
index 785a5ee89..df806b7bc 100755
--- a/apis/compute/v1beta1/zz_regionperinstanceconfig_types.go
+++ b/apis/compute/v1beta1/zz_regionperinstanceconfig_types.go
@@ -242,6 +242,7 @@ type RegionPerInstanceConfigPreservedStateInitParameters struct {
 	Disk []RegionPerInstanceConfigPreservedStateDiskInitParameters `json:"disk,omitempty" tf:"disk,omitempty"`
 
 	// Preserved metadata defined for this instance. This is a list of key->value pairs.
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 }
 
@@ -252,6 +253,7 @@ type RegionPerInstanceConfigPreservedStateObservation struct {
 	Disk []RegionPerInstanceConfigPreservedStateDiskObservation `json:"disk,omitempty" tf:"disk,omitempty"`
 
 	// Preserved metadata defined for this instance. This is a list of key->value pairs.
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 }
 
@@ -264,6 +266,7 @@ type RegionPerInstanceConfigPreservedStateParameters struct {
 
 	// Preserved metadata defined for this instance. This is a list of key->value pairs.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 }
 
diff --git a/apis/compute/v1beta1/zz_regionurlmap_types.go b/apis/compute/v1beta1/zz_regionurlmap_types.go
index a01625ea8..aa54afe37 100755
--- a/apis/compute/v1beta1/zz_regionurlmap_types.go
+++ b/apis/compute/v1beta1/zz_regionurlmap_types.go
@@ -997,6 +997,7 @@ type HostRuleInitParameters struct {
 	// hostnames, except * will match any string of ([a-z0-9-.]*). In
 	// that case, * must be the first character and must be followed in
 	// the pattern by either - or ..
+	// +listType=set
 	Hosts []*string `json:"hosts,omitempty" tf:"hosts,omitempty"`
 
 	// The name of the PathMatcher to use to match the path portion of
@@ -1014,6 +1015,7 @@ type HostRuleObservation struct {
 	// hostnames, except * will match any string of ([a-z0-9-.]*). In
 	// that case, * must be the first character and must be followed in
 	// the pattern by either - or ..
+	// +listType=set
 	Hosts []*string `json:"hosts,omitempty" tf:"hosts,omitempty"`
 
 	// The name of the PathMatcher to use to match the path portion of
@@ -1033,6 +1035,7 @@ type HostRuleParameters struct {
 	// that case, * must be the first character and must be followed in
 	// the pattern by either - or ..
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Hosts []*string `json:"hosts" tf:"hosts,omitempty"`
 
 	// The name of the PathMatcher to use to match the path portion of
@@ -1525,6 +1528,7 @@ type PathRuleInitParameters struct {
 	// * is allowed is at the end following a /. The string fed to the path matcher
 	// does not include any text after the first ? or #, and those chars are not
 	// allowed here.
+	// +listType=set
 	Paths []*string `json:"paths,omitempty" tf:"paths,omitempty"`
 
 	// In response to a matching matchRule, the load balancer performs advanced routing
@@ -1549,6 +1553,7 @@ type PathRuleObservation struct {
 	// * is allowed is at the end following a /. The string fed to the path matcher
 	// does not include any text after the first ? or #, and those chars are not
 	// allowed here.
+	// +listType=set
 	Paths []*string `json:"paths,omitempty" tf:"paths,omitempty"`
 
 	// In response to a matching matchRule, the load balancer performs advanced routing
@@ -1577,6 +1582,7 @@ type PathRuleParameters struct {
 	// does not include any text after the first ? or #, and those chars are not
 	// allowed here.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Paths []*string `json:"paths" tf:"paths,omitempty"`
 
 	// In response to a matching matchRule, the load balancer performs advanced routing
diff --git a/apis/compute/v1beta1/zz_resourcepolicy_types.go b/apis/compute/v1beta1/zz_resourcepolicy_types.go
index bfe6f6c1d..bd6862d90 100755
--- a/apis/compute/v1beta1/zz_resourcepolicy_types.go
+++ b/apis/compute/v1beta1/zz_resourcepolicy_types.go
@@ -469,10 +469,12 @@ type SnapshotPropertiesInitParameters struct {
 	GuestFlush *bool `json:"guestFlush,omitempty" tf:"guest_flush,omitempty"`
 
 	// A set of key-value pairs.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Cloud Storage bucket location to store the auto snapshot
 	// (regional or multi-regional)
+	// +listType=set
 	StorageLocations []*string `json:"storageLocations,omitempty" tf:"storage_locations,omitempty"`
 }
 
@@ -487,10 +489,12 @@ type SnapshotPropertiesObservation struct {
 	GuestFlush *bool `json:"guestFlush,omitempty" tf:"guest_flush,omitempty"`
 
 	// A set of key-value pairs.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Cloud Storage bucket location to store the auto snapshot
 	// (regional or multi-regional)
+	// +listType=set
 	StorageLocations []*string `json:"storageLocations,omitempty" tf:"storage_locations,omitempty"`
 }
 
@@ -508,11 +512,13 @@ type SnapshotPropertiesParameters struct {
 
 	// A set of key-value pairs.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Cloud Storage bucket location to store the auto snapshot
 	// (regional or multi-regional)
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	StorageLocations []*string `json:"storageLocations,omitempty" tf:"storage_locations,omitempty"`
 }
 
diff --git a/apis/compute/v1beta1/zz_route_types.go b/apis/compute/v1beta1/zz_route_types.go
index 9aabee9df..9fc05302e 100755
--- a/apis/compute/v1beta1/zz_route_types.go
+++ b/apis/compute/v1beta1/zz_route_types.go
@@ -66,6 +66,7 @@ type RouteInitParameters struct {
 	Project *string `json:"project,omitempty" tf:"project,omitempty"`
 
 	// A list of instance tags to which this route applies.
+	// +listType=set
 	Tags []*string `json:"tags,omitempty" tf:"tags,omitempty"`
 }
 
@@ -129,6 +130,7 @@ type RouteObservation struct {
 	SelfLink *string `json:"selfLink,omitempty" tf:"self_link,omitempty"`
 
 	// A list of instance tags to which this route applies.
+	// +listType=set
 	Tags []*string `json:"tags,omitempty" tf:"tags,omitempty"`
 }
 
@@ -223,6 +225,7 @@ type RouteParameters struct {
 
 	// A list of instance tags to which this route applies.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Tags []*string `json:"tags,omitempty" tf:"tags,omitempty"`
 }
 
diff --git a/apis/compute/v1beta1/zz_routernat_types.go b/apis/compute/v1beta1/zz_routernat_types.go
index fa8ac872d..0b61edf9f 100755
--- a/apis/compute/v1beta1/zz_routernat_types.go
+++ b/apis/compute/v1beta1/zz_routernat_types.go
@@ -34,12 +34,14 @@ type ActionInitParameters struct {
 	// A list of URLs of the IP resources used for this NAT rule.
 	// These IP addresses must be valid static external IP addresses assigned to the project.
 	// This field is used for public NAT.
+	// +listType=set
 	SourceNATActiveIps []*string `json:"sourceNatActiveIps,omitempty" tf:"source_nat_active_ips,omitempty"`
 
 	// A list of URLs of the IP resources to be drained.
 	// These IPs must be valid static external IPs that have been assigned to the NAT.
 	// These IPs should be used for updating/patching a NAT rule only.
 	// This field is used for public NAT.
+	// +listType=set
 	SourceNATDrainIps []*string `json:"sourceNatDrainIps,omitempty" tf:"source_nat_drain_ips,omitempty"`
 }
 
@@ -48,12 +50,14 @@ type ActionObservation struct {
 	// A list of URLs of the IP resources used for this NAT rule.
 	// These IP addresses must be valid static external IP addresses assigned to the project.
 	// This field is used for public NAT.
+	// +listType=set
 	SourceNATActiveIps []*string `json:"sourceNatActiveIps,omitempty" tf:"source_nat_active_ips,omitempty"`
 
 	// A list of URLs of the IP resources to be drained.
 	// These IPs must be valid static external IPs that have been assigned to the NAT.
 	// These IPs should be used for updating/patching a NAT rule only.
 	// This field is used for public NAT.
+	// +listType=set
 	SourceNATDrainIps []*string `json:"sourceNatDrainIps,omitempty" tf:"source_nat_drain_ips,omitempty"`
 }
 
@@ -63,6 +67,7 @@ type ActionParameters struct {
 	// These IP addresses must be valid static external IP addresses assigned to the project.
 	// This field is used for public NAT.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	SourceNATActiveIps []*string `json:"sourceNatActiveIps,omitempty" tf:"source_nat_active_ips,omitempty"`
 
 	// A list of URLs of the IP resources to be drained.
@@ -70,6 +75,7 @@ type ActionParameters struct {
 	// These IPs should be used for updating/patching a NAT rule only.
 	// This field is used for public NAT.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	SourceNATDrainIps []*string `json:"sourceNatDrainIps,omitempty" tf:"source_nat_drain_ips,omitempty"`
 }
 
@@ -77,6 +83,7 @@ type RouterNATInitParameters struct {
 
 	// A list of URLs of the IP resources to be drained. These IPs must be
 	// valid static external IPs that have been assigned to the NAT.
+	// +listType=set
 	DrainNATIps []*string `json:"drainNatIps,omitempty" tf:"drain_nat_ips,omitempty"`
 
 	// Enable Dynamic Port Allocation.
@@ -113,6 +120,7 @@ type RouterNATInitParameters struct {
 
 	// Self-links of NAT IPs. Only valid if natIpAllocateOption
 	// is set to MANUAL_ONLY.
+	// +listType=set
 	NATIps []*string `json:"natIps,omitempty" tf:"nat_ips,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -193,6 +201,7 @@ type RouterNATObservation struct {
 
 	// A list of URLs of the IP resources to be drained. These IPs must be
 	// valid static external IPs that have been assigned to the NAT.
+	// +listType=set
 	DrainNATIps []*string `json:"drainNatIps,omitempty" tf:"drain_nat_ips,omitempty"`
 
 	// Enable Dynamic Port Allocation.
@@ -232,6 +241,7 @@ type RouterNATObservation struct {
 
 	// Self-links of NAT IPs. Only valid if natIpAllocateOption
 	// is set to MANUAL_ONLY.
+	// +listType=set
 	NATIps []*string `json:"natIps,omitempty" tf:"nat_ips,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -287,6 +297,7 @@ type RouterNATParameters struct {
 	// A list of URLs of the IP resources to be drained. These IPs must be
 	// valid static external IPs that have been assigned to the NAT.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	DrainNATIps []*string `json:"drainNatIps,omitempty" tf:"drain_nat_ips,omitempty"`
 
 	// Enable Dynamic Port Allocation.
@@ -331,6 +342,7 @@ type RouterNATParameters struct {
 	// Self-links of NAT IPs. Only valid if natIpAllocateOption
 	// is set to MANUAL_ONLY.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	NATIps []*string `json:"natIps,omitempty" tf:"nat_ips,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -479,12 +491,14 @@ type SubnetworkInitParameters struct {
 	// to use NAT. This can be populated only if
 	// LIST_OF_SECONDARY_IP_RANGES is one of the values in
 	// sourceIpRangesToNat
+	// +listType=set
 	SecondaryIPRangeNames []*string `json:"secondaryIpRangeNames,omitempty" tf:"secondary_ip_range_names,omitempty"`
 
 	// List of options for which source IPs in the subnetwork
 	// should have NAT enabled. Supported values include:
 	// ALL_IP_RANGES, LIST_OF_SECONDARY_IP_RANGES,
 	// PRIMARY_IP_RANGE.
+	// +listType=set
 	SourceIPRangesToNAT []*string `json:"sourceIpRangesToNat,omitempty" tf:"source_ip_ranges_to_nat,omitempty"`
 }
 
@@ -497,12 +511,14 @@ type SubnetworkObservation struct {
 	// to use NAT. This can be populated only if
 	// LIST_OF_SECONDARY_IP_RANGES is one of the values in
 	// sourceIpRangesToNat
+	// +listType=set
 	SecondaryIPRangeNames []*string `json:"secondaryIpRangeNames,omitempty" tf:"secondary_ip_range_names,omitempty"`
 
 	// List of options for which source IPs in the subnetwork
 	// should have NAT enabled. Supported values include:
 	// ALL_IP_RANGES, LIST_OF_SECONDARY_IP_RANGES,
 	// PRIMARY_IP_RANGE.
+	// +listType=set
 	SourceIPRangesToNAT []*string `json:"sourceIpRangesToNat,omitempty" tf:"source_ip_ranges_to_nat,omitempty"`
 }
 
@@ -526,6 +542,7 @@ type SubnetworkParameters struct {
 	// LIST_OF_SECONDARY_IP_RANGES is one of the values in
 	// sourceIpRangesToNat
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	SecondaryIPRangeNames []*string `json:"secondaryIpRangeNames,omitempty" tf:"secondary_ip_range_names,omitempty"`
 
 	// List of options for which source IPs in the subnetwork
@@ -533,6 +550,7 @@ type SubnetworkParameters struct {
 	// ALL_IP_RANGES, LIST_OF_SECONDARY_IP_RANGES,
 	// PRIMARY_IP_RANGE.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	SourceIPRangesToNAT []*string `json:"sourceIpRangesToNat" tf:"source_ip_ranges_to_nat,omitempty"`
 }
 
diff --git a/apis/compute/v1beta1/zz_securitypolicy_types.go b/apis/compute/v1beta1/zz_securitypolicy_types.go
index 736513ac9..39e0c7728 100755
--- a/apis/compute/v1beta1/zz_securitypolicy_types.go
+++ b/apis/compute/v1beta1/zz_securitypolicy_types.go
@@ -122,12 +122,14 @@ type BanThresholdParameters struct {
 type ConfigInitParameters struct {
 
 	// field in config.
+	// +listType=set
 	SrcIPRanges []*string `json:"srcIpRanges,omitempty" tf:"src_ip_ranges,omitempty"`
 }
 
 type ConfigObservation struct {
 
 	// field in config.
+	// +listType=set
 	SrcIPRanges []*string `json:"srcIpRanges,omitempty" tf:"src_ip_ranges,omitempty"`
 }
 
@@ -135,6 +137,7 @@ type ConfigParameters struct {
 
 	// field in config.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	SrcIPRanges []*string `json:"srcIpRanges" tf:"src_ip_ranges,omitempty"`
 }
 
@@ -195,6 +198,7 @@ type JSONCustomConfigInitParameters struct {
 	// format of the Content-Type header values is defined in
 	// RFC 1341. When configuring a custom Content-Type header
 	// value, only the type/subtype needs to be specified, and the parameters should be excluded.
+	// +listType=set
 	ContentTypes []*string `json:"contentTypes,omitempty" tf:"content_types,omitempty"`
 }
 
@@ -204,6 +208,7 @@ type JSONCustomConfigObservation struct {
 	// format of the Content-Type header values is defined in
 	// RFC 1341. When configuring a custom Content-Type header
 	// value, only the type/subtype needs to be specified, and the parameters should be excluded.
+	// +listType=set
 	ContentTypes []*string `json:"contentTypes,omitempty" tf:"content_types,omitempty"`
 }
 
@@ -214,6 +219,7 @@ type JSONCustomConfigParameters struct {
 	// RFC 1341. When configuring a custom Content-Type header
 	// value, only the type/subtype needs to be specified, and the parameters should be excluded.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	ContentTypes []*string `json:"contentTypes" tf:"content_types,omitempty"`
 }
 
diff --git a/apis/compute/v1beta1/zz_snapshot_types.go b/apis/compute/v1beta1/zz_snapshot_types.go
index 08f0e9d04..4f2392a2f 100755
--- a/apis/compute/v1beta1/zz_snapshot_types.go
+++ b/apis/compute/v1beta1/zz_snapshot_types.go
@@ -86,6 +86,7 @@ type SnapshotInitParameters struct {
 	Description *string `json:"description,omitempty" tf:"description,omitempty"`
 
 	// Labels to apply to this Snapshot.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -145,6 +146,7 @@ type SnapshotObservation struct {
 	LabelFingerprint *string `json:"labelFingerprint,omitempty" tf:"label_fingerprint,omitempty"`
 
 	// Labels to apply to this Snapshot.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// A list of public visible licenses that apply to this snapshot. This
@@ -214,6 +216,7 @@ type SnapshotParameters struct {
 
 	// Labels to apply to this Snapshot.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
diff --git a/apis/compute/v1beta1/zz_sslpolicy_types.go b/apis/compute/v1beta1/zz_sslpolicy_types.go
index 10c1c0324..328ba9c61 100755
--- a/apis/compute/v1beta1/zz_sslpolicy_types.go
+++ b/apis/compute/v1beta1/zz_sslpolicy_types.go
@@ -40,6 +40,7 @@ type SSLPolicyInitParameters struct {
 	// for which ciphers are available to use. Note: this argument
 	// must be present when using the CUSTOM profile. This argument
 	// must not be present when using any other profile.
+	// +listType=set
 	CustomFeatures []*string `json:"customFeatures,omitempty" tf:"custom_features,omitempty"`
 
 	// An optional description of this resource.
@@ -81,12 +82,14 @@ type SSLPolicyObservation struct {
 	// for which ciphers are available to use. Note: this argument
 	// must be present when using the CUSTOM profile. This argument
 	// must not be present when using any other profile.
+	// +listType=set
 	CustomFeatures []*string `json:"customFeatures,omitempty" tf:"custom_features,omitempty"`
 
 	// An optional description of this resource.
 	Description *string `json:"description,omitempty" tf:"description,omitempty"`
 
 	// The list of features enabled in the SSL policy.
+	// +listType=set
 	EnabledFeatures []*string `json:"enabledFeatures,omitempty" tf:"enabled_features,omitempty"`
 
 	// Fingerprint of this resource. A hash of the contents stored in this
@@ -133,6 +136,7 @@ type SSLPolicyParameters struct {
 	// must be present when using the CUSTOM profile. This argument
 	// must not be present when using any other profile.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	CustomFeatures []*string `json:"customFeatures,omitempty" tf:"custom_features,omitempty"`
 
 	// An optional description of this resource.
diff --git a/apis/compute/v1beta1/zz_subnetwork_types.go b/apis/compute/v1beta1/zz_subnetwork_types.go
index 22339d27e..ece7b8552 100755
--- a/apis/compute/v1beta1/zz_subnetwork_types.go
+++ b/apis/compute/v1beta1/zz_subnetwork_types.go
@@ -178,6 +178,7 @@ type SubnetworkLogConfigInitParameters struct {
 
 	// List of metadata fields that should be added to reported logs.
 	// Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM_METADATA.
+	// +listType=set
 	MetadataFields []*string `json:"metadataFields,omitempty" tf:"metadata_fields,omitempty"`
 }
 
@@ -212,6 +213,7 @@ type SubnetworkLogConfigObservation struct {
 
 	// List of metadata fields that should be added to reported logs.
 	// Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM_METADATA.
+	// +listType=set
 	MetadataFields []*string `json:"metadataFields,omitempty" tf:"metadata_fields,omitempty"`
 }
 
@@ -251,6 +253,7 @@ type SubnetworkLogConfigParameters struct {
 	// List of metadata fields that should be added to reported logs.
 	// Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM_METADATA.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	MetadataFields []*string `json:"metadataFields,omitempty" tf:"metadata_fields,omitempty"`
 }
 
diff --git a/apis/compute/v1beta1/zz_targetpool_types.go b/apis/compute/v1beta1/zz_targetpool_types.go
index 9701532af..5dda1a151 100755
--- a/apis/compute/v1beta1/zz_targetpool_types.go
+++ b/apis/compute/v1beta1/zz_targetpool_types.go
@@ -44,6 +44,7 @@ type TargetPoolInitParameters struct {
 
 	// List of instances in the pool. They can be given as
 	// URLs, or in the form of "zone/name".
+	// +listType=set
 	Instances []*string `json:"instances,omitempty" tf:"instances,omitempty"`
 
 	// The ID of the project in which the resource belongs. If it
@@ -78,6 +79,7 @@ type TargetPoolObservation struct {
 
 	// List of instances in the pool. They can be given as
 	// URLs, or in the form of "zone/name".
+	// +listType=set
 	Instances []*string `json:"instances,omitempty" tf:"instances,omitempty"`
 
 	// The ID of the project in which the resource belongs. If it
@@ -130,6 +132,7 @@ type TargetPoolParameters struct {
 	// List of instances in the pool. They can be given as
 	// URLs, or in the form of "zone/name".
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Instances []*string `json:"instances,omitempty" tf:"instances,omitempty"`
 
 	// The ID of the project in which the resource belongs. If it
diff --git a/apis/compute/v1beta1/zz_urlmap_types.go b/apis/compute/v1beta1/zz_urlmap_types.go
index fbe42a7ee..c3b041f90 100755
--- a/apis/compute/v1beta1/zz_urlmap_types.go
+++ b/apis/compute/v1beta1/zz_urlmap_types.go
@@ -1976,6 +1976,7 @@ type PathMatcherPathRuleInitParameters struct {
 	// * is allowed is at the end following a /. The string fed to the path matcher
 	// does not include any text after the first ? or #, and those chars are not
 	// allowed here.
+	// +listType=set
 	Paths []*string `json:"paths,omitempty" tf:"paths,omitempty"`
 
 	// In response to a matching matchRule, the load balancer performs advanced routing
@@ -2000,6 +2001,7 @@ type PathMatcherPathRuleObservation struct {
 	// * is allowed is at the end following a /. The string fed to the path matcher
 	// does not include any text after the first ? or #, and those chars are not
 	// allowed here.
+	// +listType=set
 	Paths []*string `json:"paths,omitempty" tf:"paths,omitempty"`
 
 	// In response to a matching matchRule, the load balancer performs advanced routing
@@ -2028,6 +2030,7 @@ type PathMatcherPathRuleParameters struct {
 	// does not include any text after the first ? or #, and those chars are not
 	// allowed here.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Paths []*string `json:"paths" tf:"paths,omitempty"`
 
 	// In response to a matching matchRule, the load balancer performs advanced routing
@@ -4978,6 +4981,7 @@ type URLMapHostRuleInitParameters struct {
 	// The list of host patterns to match. They must be valid hostnames, except * will
 	// match any string of ([a-z0-9-.]*). In that case, * must be the first character
 	// and must be followed in the pattern by either - or ..
+	// +listType=set
 	Hosts []*string `json:"hosts,omitempty" tf:"hosts,omitempty"`
 
 	// The name of the PathMatcher to use to match the path portion of the URL if the
@@ -4994,6 +4998,7 @@ type URLMapHostRuleObservation struct {
 	// The list of host patterns to match. They must be valid hostnames, except * will
 	// match any string of ([a-z0-9-.]*). In that case, * must be the first character
 	// and must be followed in the pattern by either - or ..
+	// +listType=set
 	Hosts []*string `json:"hosts,omitempty" tf:"hosts,omitempty"`
 
 	// The name of the PathMatcher to use to match the path portion of the URL if the
@@ -5012,6 +5017,7 @@ type URLMapHostRuleParameters struct {
 	// match any string of ([a-z0-9-.]*). In that case, * must be the first character
 	// and must be followed in the pattern by either - or ..
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Hosts []*string `json:"hosts" tf:"hosts,omitempty"`
 
 	// The name of the PathMatcher to use to match the path portion of the URL if the
diff --git a/apis/compute/v1beta1/zz_vpntunnel_types.go b/apis/compute/v1beta1/zz_vpntunnel_types.go
index be63eb79d..490aaf15c 100755
--- a/apis/compute/v1beta1/zz_vpntunnel_types.go
+++ b/apis/compute/v1beta1/zz_vpntunnel_types.go
@@ -43,6 +43,7 @@ type VPNTunnelInitParameters struct {
 	// peer VPN gateway. The value should be a CIDR formatted string,
 	// for example 192.168.0.0/16. The ranges should be disjoint.
 	// Only IPv4 is supported.
+	// +listType=set
 	LocalTrafficSelector []*string `json:"localTrafficSelector,omitempty" tf:"local_traffic_selector,omitempty"`
 
 	// The interface ID of the external VPN gateway to which this VPN tunnel is connected.
@@ -65,6 +66,7 @@ type VPNTunnelInitParameters struct {
 	// peer VPN gateway. The value should be a CIDR formatted string,
 	// for example 192.168.0.0/16. The ranges should be disjoint.
 	// Only IPv4 is supported.
+	// +listType=set
 	RemoteTrafficSelector []*string `json:"remoteTrafficSelector,omitempty" tf:"remote_traffic_selector,omitempty"`
 
 	// The interface ID of the VPN gateway with which this VPN tunnel is associated.
@@ -94,6 +96,7 @@ type VPNTunnelObservation struct {
 	// peer VPN gateway. The value should be a CIDR formatted string,
 	// for example 192.168.0.0/16. The ranges should be disjoint.
 	// Only IPv4 is supported.
+	// +listType=set
 	LocalTrafficSelector []*string `json:"localTrafficSelector,omitempty" tf:"local_traffic_selector,omitempty"`
 
 	// URL of the peer side external VPN gateway to which this VPN tunnel is connected.
@@ -122,6 +125,7 @@ type VPNTunnelObservation struct {
 	// peer VPN gateway. The value should be a CIDR formatted string,
 	// for example 192.168.0.0/16. The ranges should be disjoint.
 	// Only IPv4 is supported.
+	// +listType=set
 	RemoteTrafficSelector []*string `json:"remoteTrafficSelector,omitempty" tf:"remote_traffic_selector,omitempty"`
 
 	// URL of router resource to be used for dynamic routing.
@@ -166,6 +170,7 @@ type VPNTunnelParameters struct {
 	// for example 192.168.0.0/16. The ranges should be disjoint.
 	// Only IPv4 is supported.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	LocalTrafficSelector []*string `json:"localTrafficSelector,omitempty" tf:"local_traffic_selector,omitempty"`
 
 	// URL of the peer side external VPN gateway to which this VPN tunnel is connected.
@@ -210,6 +215,7 @@ type VPNTunnelParameters struct {
 	// for example 192.168.0.0/16. The ranges should be disjoint.
 	// Only IPv4 is supported.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	RemoteTrafficSelector []*string `json:"remoteTrafficSelector,omitempty" tf:"remote_traffic_selector,omitempty"`
 
 	// URL of router resource to be used for dynamic routing.
diff --git a/apis/container/v1beta1/zz_cluster_types.go b/apis/container/v1beta1/zz_cluster_types.go
index 0d2b9dd6f..b711fd142 100755
--- a/apis/container/v1beta1/zz_cluster_types.go
+++ b/apis/container/v1beta1/zz_cluster_types.go
@@ -817,6 +817,7 @@ type ClusterInitParameters struct {
 	// are located. Nodes must be in the region of their regional cluster or in the
 	// same region as their cluster's zone for zonal clusters. If this is specified for
 	// a zonal cluster, omit the cluster's zone.
+	// +listType=set
 	NodeLocations []*string `json:"nodeLocations,omitempty" tf:"node_locations,omitempty"`
 
 	// Default NodePool settings for the entire cluster. These settings are overridden if specified on the specific NodePool object. Structure is documented below.
@@ -859,6 +860,7 @@ type ClusterInitParameters struct {
 	RemoveDefaultNodePool *bool `json:"removeDefaultNodePool,omitempty" tf:"remove_default_node_pool,omitempty"`
 
 	// The GCE resource labels (a map of key/value pairs) to be applied to the cluster.
+	// +mapType=granular
 	ResourceLabels map[string]*string `json:"resourceLabels,omitempty" tf:"resource_labels,omitempty"`
 
 	// Configuration for the
@@ -1097,6 +1099,7 @@ type ClusterObservation struct {
 	// are located. Nodes must be in the region of their regional cluster or in the
 	// same region as their cluster's zone for zonal clusters. If this is specified for
 	// a zonal cluster, omit the cluster's zone.
+	// +listType=set
 	NodeLocations []*string `json:"nodeLocations,omitempty" tf:"node_locations,omitempty"`
 
 	// List of node pools associated with this cluster.
@@ -1149,6 +1152,7 @@ type ClusterObservation struct {
 	RemoveDefaultNodePool *bool `json:"removeDefaultNodePool,omitempty" tf:"remove_default_node_pool,omitempty"`
 
 	// The GCE resource labels (a map of key/value pairs) to be applied to the cluster.
+	// +mapType=granular
 	ResourceLabels map[string]*string `json:"resourceLabels,omitempty" tf:"resource_labels,omitempty"`
 
 	// Configuration for the
@@ -1442,6 +1446,7 @@ type ClusterParameters struct {
 	// same region as their cluster's zone for zonal clusters. If this is specified for
 	// a zonal cluster, omit the cluster's zone.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	NodeLocations []*string `json:"nodeLocations,omitempty" tf:"node_locations,omitempty"`
 
 	// Default NodePool settings for the entire cluster. These settings are overridden if specified on the specific NodePool object. Structure is documented below.
@@ -1493,6 +1498,7 @@ type ClusterParameters struct {
 
 	// The GCE resource labels (a map of key/value pairs) to be applied to the cluster.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	ResourceLabels map[string]*string `json:"resourceLabels,omitempty" tf:"resource_labels,omitempty"`
 
 	// Configuration for the
@@ -1722,12 +1728,14 @@ type DefaultSnatStatusParameters struct {
 type EnableK8SBetaApisInitParameters struct {
 
 	// Enabled Kubernetes Beta APIs. To list a Beta API resource, use the representation {group}/{version}/{resource}. The version must be a Beta version. Note that you cannot disable beta APIs that are already enabled on a cluster without recreating it. See the Configure beta APIs for more information.
+	// +listType=set
 	EnabledApis []*string `json:"enabledApis,omitempty" tf:"enabled_apis,omitempty"`
 }
 
 type EnableK8SBetaApisObservation struct {
 
 	// Enabled Kubernetes Beta APIs. To list a Beta API resource, use the representation {group}/{version}/{resource}. The version must be a Beta version. Note that you cannot disable beta APIs that are already enabled on a cluster without recreating it. See the Configure beta APIs for more information.
+	// +listType=set
 	EnabledApis []*string `json:"enabledApis,omitempty" tf:"enabled_apis,omitempty"`
 }
 
@@ -1735,6 +1743,7 @@ type EnableK8SBetaApisParameters struct {
 
 	// Enabled Kubernetes Beta APIs. To list a Beta API resource, use the representation {group}/{version}/{resource}. The version must be a Beta version. Note that you cannot disable beta APIs that are already enabled on a cluster without recreating it. See the Configure beta APIs for more information.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	EnabledApis []*string `json:"enabledApis" tf:"enabled_apis,omitempty"`
 }
 
@@ -2314,6 +2323,7 @@ type LinuxNodeConfigInitParameters struct {
 	// The Linux kernel parameters to be applied to the nodes
 	// and all pods running on the nodes. Specified as a map from the key, such as
 	// net.core.wmem_max, to a string value.
+	// +mapType=granular
 	Sysctls map[string]*string `json:"sysctls,omitempty" tf:"sysctls,omitempty"`
 }
 
@@ -2322,6 +2332,7 @@ type LinuxNodeConfigObservation struct {
 	// The Linux kernel parameters to be applied to the nodes
 	// and all pods running on the nodes. Specified as a map from the key, such as
 	// net.core.wmem_max, to a string value.
+	// +mapType=granular
 	Sysctls map[string]*string `json:"sysctls,omitempty" tf:"sysctls,omitempty"`
 }
 
@@ -2331,6 +2342,7 @@ type LinuxNodeConfigParameters struct {
 	// and all pods running on the nodes. Specified as a map from the key, such as
 	// net.core.wmem_max, to a string value.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Sysctls map[string]*string `json:"sysctls" tf:"sysctls,omitempty"`
 }
 
@@ -2925,6 +2937,7 @@ type NodeConfigInitParameters struct {
 
 	// The Kubernetes labels (key/value pairs) to be applied to each node. The kubernetes.io/ and k8s.io/ prefixes are
 	// reserved by Kubernetes Core components and cannot be specified.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Linux node configuration, currently supported attributes can be found here.
@@ -2950,6 +2963,7 @@ type NodeConfigInitParameters struct {
 	// The metadata key/value pairs assigned to instances in
 	// the cluster. From GKE 1. To avoid this, set the
 	// value in your config.
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// Minimum CPU platform to be used by this instance.
@@ -2965,6 +2979,7 @@ type NodeConfigInitParameters struct {
 	// The set of Google API scopes to be made available
 	// on all of the node VMs under the "default" service account.
 	// Use the "https://www.googleapis.com/auth/cloud-platform" scope to grant access to all APIs. It is recommended that you set service_account to a non-default service account and grant IAM roles to that service account for only the resources that it needs.
+	// +listType=set
 	OAuthScopes []*string `json:"oauthScopes,omitempty" tf:"oauth_scopes,omitempty"`
 
 	// A boolean that represents whether or not the underlying node VMs
@@ -2977,6 +2992,7 @@ type NodeConfigInitParameters struct {
 
 	// The GCP labels (key/value pairs) to be applied to each node. Refer here
 	// for how these labels are applied to clusters, node pools and nodes.
+	// +mapType=granular
 	ResourceLabels map[string]*string `json:"resourceLabels,omitempty" tf:"resource_labels,omitempty"`
 
 	// Shielded Instance options. Structure is documented below.
@@ -3043,6 +3059,7 @@ type NodeConfigLinuxNodeConfigObservation struct {
 	// The Linux kernel parameters to be applied to the nodes
 	// and all pods running on the nodes. Specified as a map from the key, such as
 	// net.core.wmem_max, to a string value.
+	// +mapType=granular
 	Sysctls map[string]*string `json:"sysctls,omitempty" tf:"sysctls,omitempty"`
 }
 
@@ -3116,6 +3133,7 @@ type NodeConfigObservation struct {
 
 	// The Kubernetes labels (key/value pairs) to be applied to each node. The kubernetes.io/ and k8s.io/ prefixes are
 	// reserved by Kubernetes Core components and cannot be specified.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Linux node configuration, currently supported attributes can be found here.
@@ -3141,6 +3159,7 @@ type NodeConfigObservation struct {
 	// The metadata key/value pairs assigned to instances in
 	// the cluster. From GKE 1. To avoid this, set the
 	// value in your config.
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// Minimum CPU platform to be used by this instance.
@@ -3156,6 +3175,7 @@ type NodeConfigObservation struct {
 	// The set of Google API scopes to be made available
 	// on all of the node VMs under the "default" service account.
 	// Use the "https://www.googleapis.com/auth/cloud-platform" scope to grant access to all APIs. It is recommended that you set service_account to a non-default service account and grant IAM roles to that service account for only the resources that it needs.
+	// +listType=set
 	OAuthScopes []*string `json:"oauthScopes,omitempty" tf:"oauth_scopes,omitempty"`
 
 	// A boolean that represents whether or not the underlying node VMs
@@ -3168,6 +3188,7 @@ type NodeConfigObservation struct {
 
 	// The GCP labels (key/value pairs) to be applied to each node. Refer here
 	// for how these labels are applied to clusters, node pools and nodes.
+	// +mapType=granular
 	ResourceLabels map[string]*string `json:"resourceLabels,omitempty" tf:"resource_labels,omitempty"`
 
 	// The service account to be used by the Node VMs.
@@ -3269,6 +3290,7 @@ type NodeConfigParameters struct {
 	// The Kubernetes labels (key/value pairs) to be applied to each node. The kubernetes.io/ and k8s.io/ prefixes are
 	// reserved by Kubernetes Core components and cannot be specified.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Linux node configuration, currently supported attributes can be found here.
@@ -3300,6 +3322,7 @@ type NodeConfigParameters struct {
 	// the cluster. From GKE 1. To avoid this, set the
 	// value in your config.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// Minimum CPU platform to be used by this instance.
@@ -3318,6 +3341,7 @@ type NodeConfigParameters struct {
 	// on all of the node VMs under the "default" service account.
 	// Use the "https://www.googleapis.com/auth/cloud-platform" scope to grant access to all APIs. It is recommended that you set service_account to a non-default service account and grant IAM roles to that service account for only the resources that it needs.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	OAuthScopes []*string `json:"oauthScopes,omitempty" tf:"oauth_scopes,omitempty"`
 
 	// A boolean that represents whether or not the underlying node VMs
@@ -3333,6 +3357,7 @@ type NodeConfigParameters struct {
 	// The GCP labels (key/value pairs) to be applied to each node. Refer here
 	// for how these labels are applied to clusters, node pools and nodes.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	ResourceLabels map[string]*string `json:"resourceLabels,omitempty" tf:"resource_labels,omitempty"`
 
 	// The service account to be used by the Node VMs.
@@ -3398,6 +3423,7 @@ type NodeConfigReservationAffinityObservation struct {
 	Key *string `json:"key,omitempty" tf:"key,omitempty"`
 
 	// name"
+	// +listType=set
 	Values []*string `json:"values,omitempty" tf:"values,omitempty"`
 }
 
@@ -3563,6 +3589,7 @@ type NodePoolNodeConfigObservation struct {
 
 	// The Kubernetes labels (key/value pairs) to be applied to each node. The kubernetes.io/ and k8s.io/ prefixes are
 	// reserved by Kubernetes Core components and cannot be specified.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Linux node configuration, currently supported attributes can be found here.
@@ -3588,6 +3615,7 @@ type NodePoolNodeConfigObservation struct {
 	// The metadata key/value pairs assigned to instances in
 	// the cluster. From GKE 1. To avoid this, set the
 	// value in your config.
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// Minimum CPU platform to be used by this instance.
@@ -3603,6 +3631,7 @@ type NodePoolNodeConfigObservation struct {
 	// The set of Google API scopes to be made available
 	// on all of the node VMs under the "default" service account.
 	// Use the "https://www.googleapis.com/auth/cloud-platform" scope to grant access to all APIs. It is recommended that you set service_account to a non-default service account and grant IAM roles to that service account for only the resources that it needs.
+	// +listType=set
 	OAuthScopes []*string `json:"oauthScopes,omitempty" tf:"oauth_scopes,omitempty"`
 
 	// A boolean that represents whether or not the underlying node VMs
@@ -3614,6 +3643,7 @@ type NodePoolNodeConfigObservation struct {
 	ReservationAffinity []NodeConfigReservationAffinityObservation `json:"reservationAffinity,omitempty" tf:"reservation_affinity,omitempty"`
 
 	// The GCE resource labels (a map of key/value pairs) to be applied to the cluster.
+	// +mapType=granular
 	ResourceLabels map[string]*string `json:"resourceLabels,omitempty" tf:"resource_labels,omitempty"`
 
 	// The service account to be used by the Node VMs.
@@ -3703,6 +3733,7 @@ type NodePoolObservation struct {
 	// are located. Nodes must be in the region of their regional cluster or in the
 	// same region as their cluster's zone for zonal clusters. If this is specified for
 	// a zonal cluster, omit the cluster's zone.
+	// +listType=set
 	NodeLocations []*string `json:"nodeLocations,omitempty" tf:"node_locations,omitempty"`
 
 	PlacementPolicy []PlacementPolicyObservation `json:"placementPolicy,omitempty" tf:"placement_policy,omitempty"`
@@ -4000,6 +4031,7 @@ type ReservationAffinityInitParameters struct {
 	Key *string `json:"key,omitempty" tf:"key,omitempty"`
 
 	// name"
+	// +listType=set
 	Values []*string `json:"values,omitempty" tf:"values,omitempty"`
 }
 
@@ -4013,6 +4045,7 @@ type ReservationAffinityObservation struct {
 	Key *string `json:"key,omitempty" tf:"key,omitempty"`
 
 	// name"
+	// +listType=set
 	Values []*string `json:"values,omitempty" tf:"values,omitempty"`
 }
 
@@ -4029,6 +4062,7 @@ type ReservationAffinityParameters struct {
 
 	// name"
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Values []*string `json:"values,omitempty" tf:"values,omitempty"`
 }
 
diff --git a/apis/container/v1beta1/zz_generated_terraformed.go b/apis/container/v1beta1/zz_generated_terraformed.go
index 7b5879bf3..92e2f02da 100755
--- a/apis/container/v1beta1/zz_generated_terraformed.go
+++ b/apis/container/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Cluster) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Cluster
+func (tr *Cluster) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Cluster using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Cluster) LateInitialize(attrs []byte) (bool, error) {
@@ -195,6 +226,36 @@ func (tr *NodePool) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this NodePool
+func (tr *NodePool) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this NodePool using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *NodePool) LateInitialize(attrs []byte) (bool, error) {
@@ -279,6 +340,36 @@ func (tr *Registry) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Registry
+func (tr *Registry) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Registry using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Registry) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/container/v1beta1/zz_nodepool_types.go b/apis/container/v1beta1/zz_nodepool_types.go
index caae375b7..7c1bfc540 100755
--- a/apis/container/v1beta1/zz_nodepool_types.go
+++ b/apis/container/v1beta1/zz_nodepool_types.go
@@ -224,6 +224,7 @@ type NodePoolInitParameters_2 struct {
 	// be in the region of their regional cluster or in the same region as their
 	// cluster's zone for zonal clusters. If unspecified, the cluster-level
 	// node_locations will be used.
+	// +listType=set
 	NodeLocations []*string `json:"nodeLocations,omitempty" tf:"node_locations,omitempty"`
 
 	// Specifies a custom placement policy for the
@@ -487,6 +488,7 @@ type NodePoolNodeConfigInitParameters_2 struct {
 
 	KubeletConfig []NodePoolNodeConfigKubeletConfigInitParameters `json:"kubeletConfig,omitempty" tf:"kubelet_config,omitempty"`
 
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Parameters used in creating the node pool. See
@@ -501,18 +503,21 @@ type NodePoolNodeConfigInitParameters_2 struct {
 
 	MachineType *string `json:"machineType,omitempty" tf:"machine_type,omitempty"`
 
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	MinCPUPlatform *string `json:"minCpuPlatform,omitempty" tf:"min_cpu_platform,omitempty"`
 
 	NodeGroup *string `json:"nodeGroup,omitempty" tf:"node_group,omitempty"`
 
+	// +listType=set
 	OAuthScopes []*string `json:"oauthScopes,omitempty" tf:"oauth_scopes,omitempty"`
 
 	Preemptible *bool `json:"preemptible,omitempty" tf:"preemptible,omitempty"`
 
 	ReservationAffinity []NodePoolNodeConfigReservationAffinityInitParameters `json:"reservationAffinity,omitempty" tf:"reservation_affinity,omitempty"`
 
+	// +mapType=granular
 	ResourceLabels map[string]*string `json:"resourceLabels,omitempty" tf:"resource_labels,omitempty"`
 
 	ShieldedInstanceConfig []NodePoolNodeConfigShieldedInstanceConfigInitParameters_2 `json:"shieldedInstanceConfig,omitempty" tf:"shielded_instance_config,omitempty"`
@@ -564,16 +569,21 @@ type NodePoolNodeConfigKubeletConfigParameters struct {
 }
 
 type NodePoolNodeConfigLinuxNodeConfigInitParameters struct {
+
+	// +mapType=granular
 	Sysctls map[string]*string `json:"sysctls,omitempty" tf:"sysctls,omitempty"`
 }
 
 type NodePoolNodeConfigLinuxNodeConfigObservation struct {
+
+	// +mapType=granular
 	Sysctls map[string]*string `json:"sysctls,omitempty" tf:"sysctls,omitempty"`
 }
 
 type NodePoolNodeConfigLinuxNodeConfigParameters struct {
 
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Sysctls map[string]*string `json:"sysctls" tf:"sysctls,omitempty"`
 }
 
@@ -614,6 +624,7 @@ type NodePoolNodeConfigObservation_2 struct {
 
 	KubeletConfig []NodePoolNodeConfigKubeletConfigObservation `json:"kubeletConfig,omitempty" tf:"kubelet_config,omitempty"`
 
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Parameters used in creating the node pool. See
@@ -628,18 +639,21 @@ type NodePoolNodeConfigObservation_2 struct {
 
 	MachineType *string `json:"machineType,omitempty" tf:"machine_type,omitempty"`
 
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	MinCPUPlatform *string `json:"minCpuPlatform,omitempty" tf:"min_cpu_platform,omitempty"`
 
 	NodeGroup *string `json:"nodeGroup,omitempty" tf:"node_group,omitempty"`
 
+	// +listType=set
 	OAuthScopes []*string `json:"oauthScopes,omitempty" tf:"oauth_scopes,omitempty"`
 
 	Preemptible *bool `json:"preemptible,omitempty" tf:"preemptible,omitempty"`
 
 	ReservationAffinity []NodePoolNodeConfigReservationAffinityObservation `json:"reservationAffinity,omitempty" tf:"reservation_affinity,omitempty"`
 
+	// +mapType=granular
 	ResourceLabels map[string]*string `json:"resourceLabels,omitempty" tf:"resource_labels,omitempty"`
 
 	ServiceAccount *string `json:"serviceAccount,omitempty" tf:"service_account,omitempty"`
@@ -693,6 +707,7 @@ type NodePoolNodeConfigParameters_2 struct {
 	KubeletConfig []NodePoolNodeConfigKubeletConfigParameters `json:"kubeletConfig,omitempty" tf:"kubelet_config,omitempty"`
 
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Parameters used in creating the node pool. See
@@ -713,6 +728,7 @@ type NodePoolNodeConfigParameters_2 struct {
 	MachineType *string `json:"machineType,omitempty" tf:"machine_type,omitempty"`
 
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// +kubebuilder:validation:Optional
@@ -722,6 +738,7 @@ type NodePoolNodeConfigParameters_2 struct {
 	NodeGroup *string `json:"nodeGroup,omitempty" tf:"node_group,omitempty"`
 
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	OAuthScopes []*string `json:"oauthScopes,omitempty" tf:"oauth_scopes,omitempty"`
 
 	// +kubebuilder:validation:Optional
@@ -731,6 +748,7 @@ type NodePoolNodeConfigParameters_2 struct {
 	ReservationAffinity []NodePoolNodeConfigReservationAffinityParameters `json:"reservationAffinity,omitempty" tf:"reservation_affinity,omitempty"`
 
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	ResourceLabels map[string]*string `json:"resourceLabels,omitempty" tf:"resource_labels,omitempty"`
 
 	// +crossplane:generate:reference:type=github.com/upbound/provider-gcp/apis/cloudplatform/v1beta1.ServiceAccount
@@ -770,6 +788,7 @@ type NodePoolNodeConfigReservationAffinityInitParameters struct {
 
 	Key *string `json:"key,omitempty" tf:"key,omitempty"`
 
+	// +listType=set
 	Values []*string `json:"values,omitempty" tf:"values,omitempty"`
 }
 
@@ -778,6 +797,7 @@ type NodePoolNodeConfigReservationAffinityObservation struct {
 
 	Key *string `json:"key,omitempty" tf:"key,omitempty"`
 
+	// +listType=set
 	Values []*string `json:"values,omitempty" tf:"values,omitempty"`
 }
 
@@ -790,6 +810,7 @@ type NodePoolNodeConfigReservationAffinityParameters struct {
 	Key *string `json:"key,omitempty" tf:"key,omitempty"`
 
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Values []*string `json:"values,omitempty" tf:"values,omitempty"`
 }
 
@@ -926,6 +947,7 @@ type NodePoolObservation_2 struct {
 	// be in the region of their regional cluster or in the same region as their
 	// cluster's zone for zonal clusters. If unspecified, the cluster-level
 	// node_locations will be used.
+	// +listType=set
 	NodeLocations []*string `json:"nodeLocations,omitempty" tf:"node_locations,omitempty"`
 
 	Operation *string `json:"operation,omitempty" tf:"operation,omitempty"`
@@ -1015,6 +1037,7 @@ type NodePoolParameters_2 struct {
 	// cluster's zone for zonal clusters. If unspecified, the cluster-level
 	// node_locations will be used.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	NodeLocations []*string `json:"nodeLocations,omitempty" tf:"node_locations,omitempty"`
 
 	// Specifies a custom placement policy for the
diff --git a/apis/containeranalysis/v1beta1/zz_generated_terraformed.go b/apis/containeranalysis/v1beta1/zz_generated_terraformed.go
index fe3a4b7b5..c3b4df206 100755
--- a/apis/containeranalysis/v1beta1/zz_generated_terraformed.go
+++ b/apis/containeranalysis/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Note) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Note
+func (tr *Note) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Note using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Note) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/containeranalysis/v1beta1/zz_note_types.go b/apis/containeranalysis/v1beta1/zz_note_types.go
index a1109a47e..cfeb368ea 100755
--- a/apis/containeranalysis/v1beta1/zz_note_types.go
+++ b/apis/containeranalysis/v1beta1/zz_note_types.go
@@ -119,6 +119,7 @@ type NoteInitParameters struct {
 	Project *string `json:"project,omitempty" tf:"project,omitempty"`
 
 	// Names of other notes related to this note.
+	// +listType=set
 	RelatedNoteNames []*string `json:"relatedNoteNames,omitempty" tf:"related_note_names,omitempty"`
 
 	// URLs associated with this note and related metadata.
@@ -163,6 +164,7 @@ type NoteObservation struct {
 	Project *string `json:"project,omitempty" tf:"project,omitempty"`
 
 	// Names of other notes related to this note.
+	// +listType=set
 	RelatedNoteNames []*string `json:"relatedNoteNames,omitempty" tf:"related_note_names,omitempty"`
 
 	// URLs associated with this note and related metadata.
@@ -206,6 +208,7 @@ type NoteParameters struct {
 
 	// Names of other notes related to this note.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	RelatedNoteNames []*string `json:"relatedNoteNames,omitempty" tf:"related_note_names,omitempty"`
 
 	// URLs associated with this note and related metadata.
diff --git a/apis/containeraws/v1beta1/zz_cluster_types.go b/apis/containeraws/v1beta1/zz_cluster_types.go
index dfe515d9e..10ed02853 100755
--- a/apis/containeraws/v1beta1/zz_cluster_types.go
+++ b/apis/containeraws/v1beta1/zz_cluster_types.go
@@ -99,6 +99,7 @@ type AwsServicesAuthenticationParameters struct {
 type ClusterInitParameters struct {
 
 	// Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix  and name , separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Configuration related to the cluster RBAC settings.
@@ -126,6 +127,7 @@ type ClusterInitParameters struct {
 type ClusterObservation struct {
 
 	// Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix  and name , separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Configuration related to the cluster RBAC settings.
@@ -184,6 +186,7 @@ type ClusterParameters struct {
 
 	// Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix  and name , separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Configuration related to the cluster RBAC settings.
@@ -274,6 +277,7 @@ type ControlPlaneInitParameters struct {
 	SubnetIds []*string `json:"subnetIds,omitempty" tf:"subnet_ids,omitempty"`
 
 	// Optional. A set of AWS resource tags to propagate to all underlying managed AWS resources. Specify at most 50 pairs containing alphanumerics, spaces, and symbols (.+-=_:@/). Keys can be up to 127 Unicode characters. Values can be up to 255 Unicode characters.
+	// +mapType=granular
 	Tags map[string]*string `json:"tags,omitempty" tf:"tags,omitempty"`
 
 	// The Kubernetes version to run on control plane replicas (e.g. 1.19.10-gke.1000). You can list all supported versions on a given Google Cloud region by calling .
@@ -316,6 +320,7 @@ type ControlPlaneObservation struct {
 	SubnetIds []*string `json:"subnetIds,omitempty" tf:"subnet_ids,omitempty"`
 
 	// Optional. A set of AWS resource tags to propagate to all underlying managed AWS resources. Specify at most 50 pairs containing alphanumerics, spaces, and symbols (.+-=_:@/). Keys can be up to 127 Unicode characters. Values can be up to 255 Unicode characters.
+	// +mapType=granular
 	Tags map[string]*string `json:"tags,omitempty" tf:"tags,omitempty"`
 
 	// The Kubernetes version to run on control plane replicas (e.g. 1.19.10-gke.1000). You can list all supported versions on a given Google Cloud region by calling .
@@ -370,6 +375,7 @@ type ControlPlaneParameters struct {
 
 	// Optional. A set of AWS resource tags to propagate to all underlying managed AWS resources. Specify at most 50 pairs containing alphanumerics, spaces, and symbols (.+-=_:@/). Keys can be up to 127 Unicode characters. Values can be up to 255 Unicode characters.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Tags map[string]*string `json:"tags,omitempty" tf:"tags,omitempty"`
 
 	// The Kubernetes version to run on control plane replicas (e.g. 1.19.10-gke.1000). You can list all supported versions on a given Google Cloud region by calling .
diff --git a/apis/containeraws/v1beta1/zz_generated_terraformed.go b/apis/containeraws/v1beta1/zz_generated_terraformed.go
index b277259bd..131d62695 100755
--- a/apis/containeraws/v1beta1/zz_generated_terraformed.go
+++ b/apis/containeraws/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Cluster) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Cluster
+func (tr *Cluster) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Cluster using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Cluster) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *NodePool) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this NodePool
+func (tr *NodePool) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this NodePool using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *NodePool) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/containeraws/v1beta1/zz_nodepool_types.go b/apis/containeraws/v1beta1/zz_nodepool_types.go
index 90c8c4c4c..74ddd5ba5 100755
--- a/apis/containeraws/v1beta1/zz_nodepool_types.go
+++ b/apis/containeraws/v1beta1/zz_nodepool_types.go
@@ -121,6 +121,7 @@ type ConfigInitParameters struct {
 	InstanceType *string `json:"instanceType,omitempty" tf:"instance_type,omitempty"`
 
 	// Optional. The initial labels assigned to nodes of this node pool. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Proxy configuration for outbound HTTP(S) traffic.
@@ -136,6 +137,7 @@ type ConfigInitParameters struct {
 	SecurityGroupIds []*string `json:"securityGroupIds,omitempty" tf:"security_group_ids,omitempty"`
 
 	// Optional. Key/value metadata to assign to each underlying AWS resource. Specify at most 50 pairs containing alphanumerics, spaces, and symbols (.+-=_:@/). Keys can be up to 127 Unicode characters. Values can be up to 255 Unicode characters.
+	// +mapType=granular
 	Tags map[string]*string `json:"tags,omitempty" tf:"tags,omitempty"`
 
 	// Optional. The initial taints assigned to nodes of this node pool.
@@ -157,6 +159,7 @@ type ConfigObservation struct {
 	InstanceType *string `json:"instanceType,omitempty" tf:"instance_type,omitempty"`
 
 	// Optional. The initial labels assigned to nodes of this node pool. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Proxy configuration for outbound HTTP(S) traffic.
@@ -172,6 +175,7 @@ type ConfigObservation struct {
 	SecurityGroupIds []*string `json:"securityGroupIds,omitempty" tf:"security_group_ids,omitempty"`
 
 	// Optional. Key/value metadata to assign to each underlying AWS resource. Specify at most 50 pairs containing alphanumerics, spaces, and symbols (.+-=_:@/). Keys can be up to 127 Unicode characters. Values can be up to 255 Unicode characters.
+	// +mapType=granular
 	Tags map[string]*string `json:"tags,omitempty" tf:"tags,omitempty"`
 
 	// Optional. The initial taints assigned to nodes of this node pool.
@@ -198,6 +202,7 @@ type ConfigParameters struct {
 
 	// Optional. The initial labels assigned to nodes of this node pool. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Proxy configuration for outbound HTTP(S) traffic.
@@ -218,6 +223,7 @@ type ConfigParameters struct {
 
 	// Optional. Key/value metadata to assign to each underlying AWS resource. Specify at most 50 pairs containing alphanumerics, spaces, and symbols (.+-=_:@/). Keys can be up to 127 Unicode characters. Values can be up to 255 Unicode characters.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Tags map[string]*string `json:"tags,omitempty" tf:"tags,omitempty"`
 
 	// Optional. The initial taints assigned to nodes of this node pool.
@@ -354,6 +360,7 @@ type MaxPodsConstraintParameters struct {
 type NodePoolInitParameters struct {
 
 	// Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix  and name , separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Autoscaler configuration for this node pool.
@@ -378,6 +385,7 @@ type NodePoolInitParameters struct {
 type NodePoolObservation struct {
 
 	// Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix  and name , separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Autoscaler configuration for this node pool.
@@ -430,6 +438,7 @@ type NodePoolParameters struct {
 
 	// Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix  and name , separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Autoscaler configuration for this node pool.
diff --git a/apis/containerazure/v1beta1/zz_cluster_types.go b/apis/containerazure/v1beta1/zz_cluster_types.go
index ec6d97080..f5ec883c2 100755
--- a/apis/containerazure/v1beta1/zz_cluster_types.go
+++ b/apis/containerazure/v1beta1/zz_cluster_types.go
@@ -99,6 +99,7 @@ type AzureServicesAuthenticationParameters struct {
 type ClusterInitParameters struct {
 
 	// Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix  and name , separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Configuration related to the cluster RBAC settings.
@@ -135,6 +136,7 @@ type ClusterInitParameters struct {
 type ClusterObservation struct {
 
 	// Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix  and name , separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Configuration related to the cluster RBAC settings.
@@ -202,6 +204,7 @@ type ClusterParameters struct {
 
 	// Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix  and name , separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Configuration related to the cluster RBAC settings.
@@ -273,6 +276,7 @@ type ControlPlaneInitParameters struct {
 	SubnetID *string `json:"subnetId,omitempty" tf:"subnet_id,omitempty"`
 
 	// Optional. A set of tags to apply to all underlying control plane Azure resources.
+	// +mapType=granular
 	Tags map[string]*string `json:"tags,omitempty" tf:"tags,omitempty"`
 
 	// Optional. The Azure VM size name. Example: Standard_DS2_v2. For available VM sizes, see https://docs.microsoft.com/en-us/azure/virtual-machines/vm-naming-conventions. When unspecified, it defaults to Standard_DS2_v2.
@@ -306,6 +310,7 @@ type ControlPlaneObservation struct {
 	SubnetID *string `json:"subnetId,omitempty" tf:"subnet_id,omitempty"`
 
 	// Optional. A set of tags to apply to all underlying control plane Azure resources.
+	// +mapType=granular
 	Tags map[string]*string `json:"tags,omitempty" tf:"tags,omitempty"`
 
 	// Optional. The Azure VM size name. Example: Standard_DS2_v2. For available VM sizes, see https://docs.microsoft.com/en-us/azure/virtual-machines/vm-naming-conventions. When unspecified, it defaults to Standard_DS2_v2.
@@ -347,6 +352,7 @@ type ControlPlaneParameters struct {
 
 	// Optional. A set of tags to apply to all underlying control plane Azure resources.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Tags map[string]*string `json:"tags,omitempty" tf:"tags,omitempty"`
 
 	// Optional. The Azure VM size name. Example: Standard_DS2_v2. For available VM sizes, see https://docs.microsoft.com/en-us/azure/virtual-machines/vm-naming-conventions. When unspecified, it defaults to Standard_DS2_v2.
diff --git a/apis/containerazure/v1beta1/zz_generated_terraformed.go b/apis/containerazure/v1beta1/zz_generated_terraformed.go
index 00eab17b9..427275af5 100755
--- a/apis/containerazure/v1beta1/zz_generated_terraformed.go
+++ b/apis/containerazure/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Client) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Client
+func (tr *Client) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Client using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Client) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *Cluster) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Cluster
+func (tr *Cluster) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Cluster using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Cluster) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *NodePool) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this NodePool
+func (tr *NodePool) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this NodePool using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *NodePool) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/containerazure/v1beta1/zz_nodepool_types.go b/apis/containerazure/v1beta1/zz_nodepool_types.go
index ef6546f01..d785a0765 100755
--- a/apis/containerazure/v1beta1/zz_nodepool_types.go
+++ b/apis/containerazure/v1beta1/zz_nodepool_types.go
@@ -70,6 +70,7 @@ type ConfigInitParameters struct {
 	SSHConfig []ConfigSSHConfigInitParameters `json:"sshConfig,omitempty" tf:"ssh_config,omitempty"`
 
 	// Optional. A set of tags to apply to all underlying Azure resources for this node pool. This currently only includes Virtual Machine Scale Sets. Specify at most 50 pairs containing alphanumerics, spaces, and symbols (.+-=_:@/). Keys can be up to 127 Unicode characters. Values can be up to 255 Unicode characters.
+	// +mapType=granular
 	Tags map[string]*string `json:"tags,omitempty" tf:"tags,omitempty"`
 
 	// Optional. The Azure VM size name. Example: Standard_DS2_v2. See (/anthos/clusters/docs/azure/reference/supported-vms) for options. When unspecified, it defaults to Standard_DS2_v2.
@@ -88,6 +89,7 @@ type ConfigObservation struct {
 	SSHConfig []ConfigSSHConfigObservation `json:"sshConfig,omitempty" tf:"ssh_config,omitempty"`
 
 	// Optional. A set of tags to apply to all underlying Azure resources for this node pool. This currently only includes Virtual Machine Scale Sets. Specify at most 50 pairs containing alphanumerics, spaces, and symbols (.+-=_:@/). Keys can be up to 127 Unicode characters. Values can be up to 255 Unicode characters.
+	// +mapType=granular
 	Tags map[string]*string `json:"tags,omitempty" tf:"tags,omitempty"`
 
 	// Optional. The Azure VM size name. Example: Standard_DS2_v2. See (/anthos/clusters/docs/azure/reference/supported-vms) for options. When unspecified, it defaults to Standard_DS2_v2.
@@ -110,6 +112,7 @@ type ConfigParameters struct {
 
 	// Optional. A set of tags to apply to all underlying Azure resources for this node pool. This currently only includes Virtual Machine Scale Sets. Specify at most 50 pairs containing alphanumerics, spaces, and symbols (.+-=_:@/). Keys can be up to 127 Unicode characters. Values can be up to 255 Unicode characters.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Tags map[string]*string `json:"tags,omitempty" tf:"tags,omitempty"`
 
 	// Optional. The Azure VM size name. Example: Standard_DS2_v2. See (/anthos/clusters/docs/azure/reference/supported-vms) for options. When unspecified, it defaults to Standard_DS2_v2.
@@ -206,6 +209,7 @@ type MaxPodsConstraintParameters struct {
 type NodePoolInitParameters struct {
 
 	// Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix  and name , separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Autoscaler configuration for this node pool.
@@ -233,6 +237,7 @@ type NodePoolInitParameters struct {
 type NodePoolObservation struct {
 
 	// Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix  and name , separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Autoscaler configuration for this node pool.
@@ -288,6 +293,7 @@ type NodePoolParameters struct {
 
 	// Optional. Annotations on the node pool. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix  and name , separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Annotations map[string]*string `json:"annotations,omitempty" tf:"annotations,omitempty"`
 
 	// Autoscaler configuration for this node pool.
diff --git a/apis/datacatalog/v1beta1/zz_generated_terraformed.go b/apis/datacatalog/v1beta1/zz_generated_terraformed.go
index a4c72e5ab..b77fa201b 100755
--- a/apis/datacatalog/v1beta1/zz_generated_terraformed.go
+++ b/apis/datacatalog/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Entry) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Entry
+func (tr *Entry) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Entry using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Entry) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *EntryGroup) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this EntryGroup
+func (tr *EntryGroup) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this EntryGroup using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *EntryGroup) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *Tag) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Tag
+func (tr *Tag) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Tag using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Tag) LateInitialize(attrs []byte) (bool, error) {
@@ -347,6 +438,36 @@ func (tr *TagTemplate) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this TagTemplate
+func (tr *TagTemplate) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this TagTemplate using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *TagTemplate) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/dataflow/v1beta1/zz_generated_terraformed.go b/apis/dataflow/v1beta1/zz_generated_terraformed.go
index 78665cfe6..96edbf738 100755
--- a/apis/dataflow/v1beta1/zz_generated_terraformed.go
+++ b/apis/dataflow/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Job) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Job
+func (tr *Job) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Job using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Job) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/dataflow/v1beta1/zz_job_types.go b/apis/dataflow/v1beta1/zz_job_types.go
index 398cb9467..cf4b23225 100755
--- a/apis/dataflow/v1beta1/zz_job_types.go
+++ b/apis/dataflow/v1beta1/zz_job_types.go
@@ -32,6 +32,7 @@ import (
 type JobInitParameters struct {
 
 	// List of experiments that should be used by the job. An example value is ["enable_stackdriver_agent_metrics"].
+	// +listType=set
 	AdditionalExperiments []*string `json:"additionalExperiments,omitempty" tf:"additional_experiments,omitempty"`
 
 	// Enable/disable the use of Streaming Engine for the job. Note that Streaming Engine is enabled by default for pipelines developed against the Beam SDK for Python v2.21.0 or later when using Python 3.
@@ -98,6 +99,7 @@ type JobInitParameters struct {
 type JobObservation struct {
 
 	// List of experiments that should be used by the job. An example value is ["enable_stackdriver_agent_metrics"].
+	// +listType=set
 	AdditionalExperiments []*string `json:"additionalExperiments,omitempty" tf:"additional_experiments,omitempty"`
 
 	// Enable/disable the use of Streaming Engine for the job. Note that Streaming Engine is enabled by default for pipelines developed against the Beam SDK for Python v2.21.0 or later when using Python 3.
@@ -176,6 +178,7 @@ type JobParameters struct {
 
 	// List of experiments that should be used by the job. An example value is ["enable_stackdriver_agent_metrics"].
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	AdditionalExperiments []*string `json:"additionalExperiments,omitempty" tf:"additional_experiments,omitempty"`
 
 	// Enable/disable the use of Streaming Engine for the job. Note that Streaming Engine is enabled by default for pipelines developed against the Beam SDK for Python v2.21.0 or later when using Python 3.
diff --git a/apis/datafusion/v1beta1/zz_generated_terraformed.go b/apis/datafusion/v1beta1/zz_generated_terraformed.go
index 9038e3d0d..f019b1423 100755
--- a/apis/datafusion/v1beta1/zz_generated_terraformed.go
+++ b/apis/datafusion/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Instance) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Instance
+func (tr *Instance) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Instance using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Instance) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/datafusion/v1beta1/zz_instance_types.go b/apis/datafusion/v1beta1/zz_instance_types.go
index 4a6c2a86f..98ed03e68 100755
--- a/apis/datafusion/v1beta1/zz_instance_types.go
+++ b/apis/datafusion/v1beta1/zz_instance_types.go
@@ -162,6 +162,7 @@ type InstanceInitParameters struct {
 
 	// The resource labels for instance to use to annotate any related underlying resources,
 	// such as Compute Engine VMs.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Network configuration options. These are required when a private Data Fusion instance is to be created.
@@ -169,6 +170,7 @@ type InstanceInitParameters struct {
 	NetworkConfig []NetworkConfigInitParameters `json:"networkConfig,omitempty" tf:"network_config,omitempty"`
 
 	// Map of additional options used to configure the behavior of Data Fusion instance.
+	// +mapType=granular
 	Options map[string]*string `json:"options,omitempty" tf:"options,omitempty"`
 
 	// Specifies whether the Data Fusion instance should be private. If set to
@@ -239,6 +241,7 @@ type InstanceObservation struct {
 
 	// The resource labels for instance to use to annotate any related underlying resources,
 	// such as Compute Engine VMs.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Network configuration options. These are required when a private Data Fusion instance is to be created.
@@ -246,6 +249,7 @@ type InstanceObservation struct {
 	NetworkConfig []NetworkConfigObservation `json:"networkConfig,omitempty" tf:"network_config,omitempty"`
 
 	// Map of additional options used to configure the behavior of Data Fusion instance.
+	// +mapType=granular
 	Options map[string]*string `json:"options,omitempty" tf:"options,omitempty"`
 
 	// P4 service account for the customer project.
@@ -335,6 +339,7 @@ type InstanceParameters struct {
 	// The resource labels for instance to use to annotate any related underlying resources,
 	// such as Compute Engine VMs.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Network configuration options. These are required when a private Data Fusion instance is to be created.
@@ -344,6 +349,7 @@ type InstanceParameters struct {
 
 	// Map of additional options used to configure the behavior of Data Fusion instance.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Options map[string]*string `json:"options,omitempty" tf:"options,omitempty"`
 
 	// Specifies whether the Data Fusion instance should be private. If set to
diff --git a/apis/datalossprevention/v1beta1/zz_generated_terraformed.go b/apis/datalossprevention/v1beta1/zz_generated_terraformed.go
index eb7e0c85f..404bac992 100755
--- a/apis/datalossprevention/v1beta1/zz_generated_terraformed.go
+++ b/apis/datalossprevention/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *DeidentifyTemplate) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this DeidentifyTemplate
+func (tr *DeidentifyTemplate) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this DeidentifyTemplate using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *DeidentifyTemplate) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *InspectTemplate) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this InspectTemplate
+func (tr *InspectTemplate) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this InspectTemplate using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *InspectTemplate) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *JobTrigger) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this JobTrigger
+func (tr *JobTrigger) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this JobTrigger using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *JobTrigger) LateInitialize(attrs []byte) (bool, error) {
@@ -347,6 +438,36 @@ func (tr *StoredInfoType) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this StoredInfoType
+func (tr *StoredInfoType) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this StoredInfoType using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *StoredInfoType) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/datalossprevention/v1beta1/zz_jobtrigger_types.go b/apis/datalossprevention/v1beta1/zz_jobtrigger_types.go
index e3cc10ee0..9b0c2b3ad 100755
--- a/apis/datalossprevention/v1beta1/zz_jobtrigger_types.go
+++ b/apis/datalossprevention/v1beta1/zz_jobtrigger_types.go
@@ -1042,6 +1042,7 @@ type HybridOptionsInitParameters struct {
 	// Label values must be between 0 and 63 characters long and must conform to the regular expression ([a-z]([-a-z0-9]*[a-z0-9])?)?.
 	// No more than 10 labels can be associated with a given finding.
 	// Examples:
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// These are labels that each inspection request must include within their 'finding_labels' map. Request
@@ -1065,6 +1066,7 @@ type HybridOptionsObservation struct {
 	// Label values must be between 0 and 63 characters long and must conform to the regular expression ([a-z]([-a-z0-9]*[a-z0-9])?)?.
 	// No more than 10 labels can be associated with a given finding.
 	// Examples:
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// These are labels that each inspection request must include within their 'finding_labels' map. Request
@@ -1090,6 +1092,7 @@ type HybridOptionsParameters struct {
 	// No more than 10 labels can be associated with a given finding.
 	// Examples:
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// These are labels that each inspection request must include within their 'finding_labels' map. Request
diff --git a/apis/dataplex/v1beta1/zz_asset_types.go b/apis/dataplex/v1beta1/zz_asset_types.go
index 3d3649e16..87cb82dd5 100755
--- a/apis/dataplex/v1beta1/zz_asset_types.go
+++ b/apis/dataplex/v1beta1/zz_asset_types.go
@@ -41,6 +41,7 @@ type AssetInitParameters struct {
 	DisplayName *string `json:"displayName,omitempty" tf:"display_name,omitempty"`
 
 	// Optional. User defined labels for the asset.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The project for the resource
@@ -74,6 +75,7 @@ type AssetObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// Optional. User defined labels for the asset.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The lake for the resource
@@ -133,6 +135,7 @@ type AssetParameters struct {
 
 	// Optional. User defined labels for the asset.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The lake for the resource
diff --git a/apis/dataplex/v1beta1/zz_generated_terraformed.go b/apis/dataplex/v1beta1/zz_generated_terraformed.go
index f13e9203c..3f2856668 100755
--- a/apis/dataplex/v1beta1/zz_generated_terraformed.go
+++ b/apis/dataplex/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Asset) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Asset
+func (tr *Asset) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Asset using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Asset) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *Lake) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Lake
+func (tr *Lake) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Lake using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Lake) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *Zone) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Zone
+func (tr *Zone) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Zone using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Zone) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/dataplex/v1beta1/zz_lake_types.go b/apis/dataplex/v1beta1/zz_lake_types.go
index 4a3e57e74..77880a633 100755
--- a/apis/dataplex/v1beta1/zz_lake_types.go
+++ b/apis/dataplex/v1beta1/zz_lake_types.go
@@ -53,6 +53,7 @@ type LakeInitParameters struct {
 	DisplayName *string `json:"displayName,omitempty" tf:"display_name,omitempty"`
 
 	// Optional. User-defined labels for the lake.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Optional. Settings to manage lake and Dataproc Metastore service instance association.
@@ -80,6 +81,7 @@ type LakeObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// Optional. User-defined labels for the lake.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The location for the resource
@@ -119,6 +121,7 @@ type LakeParameters struct {
 
 	// Optional. User-defined labels for the lake.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The location for the resource
diff --git a/apis/dataplex/v1beta1/zz_zone_types.go b/apis/dataplex/v1beta1/zz_zone_types.go
index bea86cbfb..dbbe2c2b4 100755
--- a/apis/dataplex/v1beta1/zz_zone_types.go
+++ b/apis/dataplex/v1beta1/zz_zone_types.go
@@ -203,6 +203,7 @@ type ZoneInitParameters struct {
 	DisplayName *string `json:"displayName,omitempty" tf:"display_name,omitempty"`
 
 	// Optional. User defined labels for the zone.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The project for the resource
@@ -236,6 +237,7 @@ type ZoneObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// Optional. User defined labels for the zone.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The lake for the resource
@@ -279,6 +281,7 @@ type ZoneParameters struct {
 
 	// Optional. User defined labels for the zone.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The lake for the resource
diff --git a/apis/dataproc/v1beta1/zz_cluster_types.go b/apis/dataproc/v1beta1/zz_cluster_types.go
index 5a4d75d60..0d31799cf 100755
--- a/apis/dataproc/v1beta1/zz_cluster_types.go
+++ b/apis/dataproc/v1beta1/zz_cluster_types.go
@@ -514,6 +514,7 @@ type ClusterInitParameters struct {
 	// The list of labels (key/value pairs) to be applied to
 	// instances in the cluster. GCP generates some itself including goog-dataproc-cluster-name
 	// which is the name of the cluster.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The name of the cluster, unique within the project and
@@ -553,6 +554,7 @@ type ClusterObservation struct {
 	// The list of labels (key/value pairs) to be applied to
 	// instances in the cluster. GCP generates some itself including goog-dataproc-cluster-name
 	// which is the name of the cluster.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The name of the cluster, unique within the project and
@@ -593,6 +595,7 @@ type ClusterParameters struct {
 	// instances in the cluster. GCP generates some itself including goog-dataproc-cluster-name
 	// which is the name of the cluster.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The name of the cluster, unique within the project and
@@ -803,6 +806,7 @@ type EndpointConfigObservation struct {
 
 	// The map of port descriptions to URLs. Will only be populated if
 	// enable_http_port_access is true.
+	// +mapType=granular
 	HTTPPorts map[string]*string `json:"httpPorts,omitempty" tf:"http_ports,omitempty"`
 }
 
@@ -825,6 +829,7 @@ type GceClusterConfigInitParameters struct {
 
 	// A map of the Compute Engine metadata entries to add to all instances
 	// (see Project and instance metadata).
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// The name or self_link of the Google Compute Engine
@@ -843,6 +848,7 @@ type GceClusterConfigInitParameters struct {
 	// specified. Both OAuth2 URLs and gcloud
 	// short names are supported. To allow full access to all Cloud APIs, use the
 	// cloud-platform scope. See a complete list of scopes here.
+	// +listType=set
 	ServiceAccountScopes []*string `json:"serviceAccountScopes,omitempty" tf:"service_account_scopes,omitempty"`
 
 	// Shielded Instance Config for clusters using Compute Engine Shielded VMs.
@@ -854,6 +860,7 @@ type GceClusterConfigInitParameters struct {
 
 	// The list of instance tags applied to instances in the cluster.
 	// Tags are used to identify valid sources or targets for network firewalls.
+	// +listType=set
 	Tags []*string `json:"tags,omitempty" tf:"tags,omitempty"`
 
 	// The GCP zone where your data is stored and used (i.e. where
@@ -877,6 +884,7 @@ type GceClusterConfigObservation struct {
 
 	// A map of the Compute Engine metadata entries to add to all instances
 	// (see Project and instance metadata).
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// The name or self_link of the Google Compute Engine
@@ -899,6 +907,7 @@ type GceClusterConfigObservation struct {
 	// specified. Both OAuth2 URLs and gcloud
 	// short names are supported. To allow full access to all Cloud APIs, use the
 	// cloud-platform scope. See a complete list of scopes here.
+	// +listType=set
 	ServiceAccountScopes []*string `json:"serviceAccountScopes,omitempty" tf:"service_account_scopes,omitempty"`
 
 	// Shielded Instance Config for clusters using Compute Engine Shielded VMs.
@@ -910,6 +919,7 @@ type GceClusterConfigObservation struct {
 
 	// The list of instance tags applied to instances in the cluster.
 	// Tags are used to identify valid sources or targets for network firewalls.
+	// +listType=set
 	Tags []*string `json:"tags,omitempty" tf:"tags,omitempty"`
 
 	// The GCP zone where your data is stored and used (i.e. where
@@ -935,6 +945,7 @@ type GceClusterConfigParameters struct {
 	// A map of the Compute Engine metadata entries to add to all instances
 	// (see Project and instance metadata).
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// The name or self_link of the Google Compute Engine
@@ -968,6 +979,7 @@ type GceClusterConfigParameters struct {
 	// short names are supported. To allow full access to all Cloud APIs, use the
 	// cloud-platform scope. See a complete list of scopes here.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	ServiceAccountScopes []*string `json:"serviceAccountScopes,omitempty" tf:"service_account_scopes,omitempty"`
 
 	// Selector for a ServiceAccount in cloudplatform to populate serviceAccount.
@@ -986,6 +998,7 @@ type GceClusterConfigParameters struct {
 	// The list of instance tags applied to instances in the cluster.
 	// Tags are used to identify valid sources or targets for network firewalls.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Tags []*string `json:"tags,omitempty" tf:"tags,omitempty"`
 
 	// The GCP zone where your data is stored and used (i.e. where
@@ -1334,10 +1347,12 @@ type KubernetesSoftwareConfigInitParameters struct {
 
 	// The components that should be installed in this Dataproc cluster. The key must be a string from the
 	// KubernetesComponent enumeration. The value is the version of the software to be installed. At least one entry must be specified.
+	// +mapType=granular
 	ComponentVersion map[string]*string `json:"componentVersion,omitempty" tf:"component_version,omitempty"`
 
 	// The properties to set on daemon config files. Property keys are specified in prefix:property format,
 	// for example spark:spark.kubernetes.container.image.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 }
 
@@ -1345,10 +1360,12 @@ type KubernetesSoftwareConfigObservation struct {
 
 	// The components that should be installed in this Dataproc cluster. The key must be a string from the
 	// KubernetesComponent enumeration. The value is the version of the software to be installed. At least one entry must be specified.
+	// +mapType=granular
 	ComponentVersion map[string]*string `json:"componentVersion,omitempty" tf:"component_version,omitempty"`
 
 	// The properties to set on daemon config files. Property keys are specified in prefix:property format,
 	// for example spark:spark.kubernetes.container.image.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 }
 
@@ -1357,11 +1374,13 @@ type KubernetesSoftwareConfigParameters struct {
 	// The components that should be installed in this Dataproc cluster. The key must be a string from the
 	// KubernetesComponent enumeration. The value is the version of the software to be installed. At least one entry must be specified.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	ComponentVersion map[string]*string `json:"componentVersion" tf:"component_version,omitempty"`
 
 	// The properties to set on daemon config files. Property keys are specified in prefix:property format,
 	// for example spark:spark.kubernetes.container.image.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 }
 
@@ -1523,6 +1542,7 @@ type MetastoreConfigParameters struct {
 type MetricsInitParameters struct {
 
 	// One or more [available OSS metrics] (https://cloud.google.com/dataproc/docs/guides/monitoring#available_oss_metrics) to collect for the metric course.
+	// +listType=set
 	MetricOverrides []*string `json:"metricOverrides,omitempty" tf:"metric_overrides,omitempty"`
 
 	// A source for the collection of Dataproc OSS metrics (see available OSS metrics).
@@ -1532,6 +1552,7 @@ type MetricsInitParameters struct {
 type MetricsObservation struct {
 
 	// One or more [available OSS metrics] (https://cloud.google.com/dataproc/docs/guides/monitoring#available_oss_metrics) to collect for the metric course.
+	// +listType=set
 	MetricOverrides []*string `json:"metricOverrides,omitempty" tf:"metric_overrides,omitempty"`
 
 	// A source for the collection of Dataproc OSS metrics (see available OSS metrics).
@@ -1542,6 +1563,7 @@ type MetricsParameters struct {
 
 	// One or more [available OSS metrics] (https://cloud.google.com/dataproc/docs/guides/monitoring#available_oss_metrics) to collect for the metric course.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	MetricOverrides []*string `json:"metricOverrides,omitempty" tf:"metric_overrides,omitempty"`
 
 	// A source for the collection of Dataproc OSS metrics (see available OSS metrics).
@@ -1579,6 +1601,7 @@ type NodePoolConfigInitParameters struct {
 
 	// The list of Compute Engine zones where node pool nodes associated
 	// with a Dataproc on GKE virtual cluster will be located.
+	// +listType=set
 	Locations []*string `json:"locations,omitempty" tf:"locations,omitempty"`
 }
 
@@ -1593,6 +1616,7 @@ type NodePoolConfigObservation struct {
 
 	// The list of Compute Engine zones where node pool nodes associated
 	// with a Dataproc on GKE virtual cluster will be located.
+	// +listType=set
 	Locations []*string `json:"locations,omitempty" tf:"locations,omitempty"`
 }
 
@@ -1610,6 +1634,7 @@ type NodePoolConfigParameters struct {
 	// The list of Compute Engine zones where node pool nodes associated
 	// with a Dataproc on GKE virtual cluster will be located.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Locations []*string `json:"locations" tf:"locations,omitempty"`
 }
 
@@ -1626,6 +1651,7 @@ type NodePoolTargetInitParameters struct {
 
 	// The roles associated with the GKE node pool.
 	// One of "DEFAULT", "CONTROLLER", "SPARK_DRIVER" or "SPARK_EXECUTOR".
+	// +listType=set
 	Roles []*string `json:"roles,omitempty" tf:"roles,omitempty"`
 }
 
@@ -1642,6 +1668,7 @@ type NodePoolTargetObservation struct {
 
 	// The roles associated with the GKE node pool.
 	// One of "DEFAULT", "CONTROLLER", "SPARK_DRIVER" or "SPARK_EXECUTOR".
+	// +listType=set
 	Roles []*string `json:"roles,omitempty" tf:"roles,omitempty"`
 }
 
@@ -1661,6 +1688,7 @@ type NodePoolTargetParameters struct {
 	// The roles associated with the GKE node pool.
 	// One of "DEFAULT", "CONTROLLER", "SPARK_DRIVER" or "SPARK_EXECUTOR".
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Roles []*string `json:"roles" tf:"roles,omitempty"`
 }
 
@@ -1779,6 +1807,7 @@ type ReservationAffinityInitParameters struct {
 	Key *string `json:"key,omitempty" tf:"key,omitempty"`
 
 	// Corresponds to the label values of reservation resource.
+	// +listType=set
 	Values []*string `json:"values,omitempty" tf:"values,omitempty"`
 }
 
@@ -1791,6 +1820,7 @@ type ReservationAffinityObservation struct {
 	Key *string `json:"key,omitempty" tf:"key,omitempty"`
 
 	// Corresponds to the label values of reservation resource.
+	// +listType=set
 	Values []*string `json:"values,omitempty" tf:"values,omitempty"`
 }
 
@@ -1806,6 +1836,7 @@ type ReservationAffinityParameters struct {
 
 	// Corresponds to the label values of reservation resource.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Values []*string `json:"values,omitempty" tf:"values,omitempty"`
 }
 
@@ -1877,12 +1908,14 @@ type SoftwareConfigInitParameters struct {
 	ImageVersion *string `json:"imageVersion,omitempty" tf:"image_version,omitempty"`
 
 	// The set of optional components to activate on the cluster. See Available Optional Components.
+	// +listType=set
 	OptionalComponents []*string `json:"optionalComponents,omitempty" tf:"optional_components,omitempty"`
 
 	// A list of override and additional properties (key/value pairs)
 	// used to modify various aspects of the common configuration files used when creating
 	// a cluster. For a list of valid properties please see
 	// Cluster properties
+	// +mapType=granular
 	OverrideProperties map[string]*string `json:"overrideProperties,omitempty" tf:"override_properties,omitempty"`
 }
 
@@ -1896,12 +1929,14 @@ type SoftwareConfigObservation struct {
 	ImageVersion *string `json:"imageVersion,omitempty" tf:"image_version,omitempty"`
 
 	// The set of optional components to activate on the cluster. See Available Optional Components.
+	// +listType=set
 	OptionalComponents []*string `json:"optionalComponents,omitempty" tf:"optional_components,omitempty"`
 
 	// A list of override and additional properties (key/value pairs)
 	// used to modify various aspects of the common configuration files used when creating
 	// a cluster. For a list of valid properties please see
 	// Cluster properties
+	// +mapType=granular
 	OverrideProperties map[string]*string `json:"overrideProperties,omitempty" tf:"override_properties,omitempty"`
 
 	// The properties to set on daemon config files. Property keys are specified in prefix:property format,
@@ -1921,6 +1956,7 @@ type SoftwareConfigParameters struct {
 
 	// The set of optional components to activate on the cluster. See Available Optional Components.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	OptionalComponents []*string `json:"optionalComponents,omitempty" tf:"optional_components,omitempty"`
 
 	// A list of override and additional properties (key/value pairs)
@@ -1928,6 +1964,7 @@ type SoftwareConfigParameters struct {
 	// a cluster. For a list of valid properties please see
 	// Cluster properties
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	OverrideProperties map[string]*string `json:"overrideProperties,omitempty" tf:"override_properties,omitempty"`
 }
 
diff --git a/apis/dataproc/v1beta1/zz_generated_terraformed.go b/apis/dataproc/v1beta1/zz_generated_terraformed.go
index 2b8f7bcd6..07c2855c4 100755
--- a/apis/dataproc/v1beta1/zz_generated_terraformed.go
+++ b/apis/dataproc/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *AutoscalingPolicy) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this AutoscalingPolicy
+func (tr *AutoscalingPolicy) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this AutoscalingPolicy using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *AutoscalingPolicy) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *Cluster) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Cluster
+func (tr *Cluster) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Cluster using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Cluster) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *Job) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Job
+func (tr *Job) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Job using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Job) LateInitialize(attrs []byte) (bool, error) {
@@ -347,6 +438,36 @@ func (tr *MetastoreService) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this MetastoreService
+func (tr *MetastoreService) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this MetastoreService using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *MetastoreService) LateInitialize(attrs []byte) (bool, error) {
@@ -431,6 +552,36 @@ func (tr *WorkflowTemplate) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this WorkflowTemplate
+func (tr *WorkflowTemplate) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this WorkflowTemplate using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *WorkflowTemplate) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/dataproc/v1beta1/zz_job_types.go b/apis/dataproc/v1beta1/zz_job_types.go
index 300356d24..1551b218b 100755
--- a/apis/dataproc/v1beta1/zz_job_types.go
+++ b/apis/dataproc/v1beta1/zz_job_types.go
@@ -52,6 +52,7 @@ type HadoopConfigInitParameters struct {
 	MainJarFileURI *string `json:"mainJarFileUri,omitempty" tf:"main_jar_file_uri,omitempty"`
 
 	// A mapping of property names to values, used to configure Hadoop. Properties that conflict with values set by the Cloud Dataproc API may be overwritten. Can include properties set in /etc/hadoop/conf/*-site and classes in user code..
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 }
 
@@ -78,6 +79,7 @@ type HadoopConfigObservation struct {
 	MainJarFileURI *string `json:"mainJarFileUri,omitempty" tf:"main_jar_file_uri,omitempty"`
 
 	// A mapping of property names to values, used to configure Hadoop. Properties that conflict with values set by the Cloud Dataproc API may be overwritten. Can include properties set in /etc/hadoop/conf/*-site and classes in user code..
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 }
 
@@ -112,6 +114,7 @@ type HadoopConfigParameters struct {
 
 	// A mapping of property names to values, used to configure Hadoop. Properties that conflict with values set by the Cloud Dataproc API may be overwritten. Can include properties set in /etc/hadoop/conf/*-site and classes in user code..
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 }
 
@@ -124,6 +127,7 @@ type HiveConfigInitParameters struct {
 	JarFileUris []*string `json:"jarFileUris,omitempty" tf:"jar_file_uris,omitempty"`
 
 	// A mapping of property names and values, used to configure Hive. Properties that conflict with values set by the Cloud Dataproc API may be overwritten. Can include properties set in /etc/hadoop/conf/*-site.xml, /etc/hive/conf/hive-site.xml, and classes in user code..
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// HCFS URI of file containing Hive script to execute as the job.
@@ -135,6 +139,7 @@ type HiveConfigInitParameters struct {
 	QueryList []*string `json:"queryList,omitempty" tf:"query_list,omitempty"`
 
 	// Mapping of query variable names to values (equivalent to the Hive command: SET name="value";).
+	// +mapType=granular
 	ScriptVariables map[string]*string `json:"scriptVariables,omitempty" tf:"script_variables,omitempty"`
 }
 
@@ -147,6 +152,7 @@ type HiveConfigObservation struct {
 	JarFileUris []*string `json:"jarFileUris,omitempty" tf:"jar_file_uris,omitempty"`
 
 	// A mapping of property names and values, used to configure Hive. Properties that conflict with values set by the Cloud Dataproc API may be overwritten. Can include properties set in /etc/hadoop/conf/*-site.xml, /etc/hive/conf/hive-site.xml, and classes in user code..
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// HCFS URI of file containing Hive script to execute as the job.
@@ -158,6 +164,7 @@ type HiveConfigObservation struct {
 	QueryList []*string `json:"queryList,omitempty" tf:"query_list,omitempty"`
 
 	// Mapping of query variable names to values (equivalent to the Hive command: SET name="value";).
+	// +mapType=granular
 	ScriptVariables map[string]*string `json:"scriptVariables,omitempty" tf:"script_variables,omitempty"`
 }
 
@@ -173,6 +180,7 @@ type HiveConfigParameters struct {
 
 	// A mapping of property names and values, used to configure Hive. Properties that conflict with values set by the Cloud Dataproc API may be overwritten. Can include properties set in /etc/hadoop/conf/*-site.xml, /etc/hive/conf/hive-site.xml, and classes in user code..
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// HCFS URI of file containing Hive script to execute as the job.
@@ -187,6 +195,7 @@ type HiveConfigParameters struct {
 
 	// Mapping of query variable names to values (equivalent to the Hive command: SET name="value";).
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	ScriptVariables map[string]*string `json:"scriptVariables,omitempty" tf:"script_variables,omitempty"`
 }
 
@@ -202,6 +211,7 @@ type JobInitParameters struct {
 	HiveConfig []HiveConfigInitParameters `json:"hiveConfig,omitempty" tf:"hive_config,omitempty"`
 
 	// The list of labels (key/value pairs) to add to the job.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	PigConfig []PigConfigInitParameters `json:"pigConfig,omitempty" tf:"pig_config,omitempty"`
@@ -245,6 +255,7 @@ type JobObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// The list of labels (key/value pairs) to add to the job.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	PigConfig []PigConfigObservation `json:"pigConfig,omitempty" tf:"pig_config,omitempty"`
@@ -290,6 +301,7 @@ type JobParameters struct {
 
 	// The list of labels (key/value pairs) to add to the job.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// +kubebuilder:validation:Optional
@@ -340,12 +352,14 @@ type JobParameters struct {
 type LoggingConfigInitParameters struct {
 
 	// The per-package log levels for the driver. This may include 'root' package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
 type LoggingConfigObservation struct {
 
 	// The per-package log levels for the driver. This may include 'root' package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
@@ -353,6 +367,7 @@ type LoggingConfigParameters struct {
 
 	// The per-package log levels for the driver. This may include 'root' package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels" tf:"driver_log_levels,omitempty"`
 }
 
@@ -367,6 +382,7 @@ type PigConfigInitParameters struct {
 	LoggingConfig []PigConfigLoggingConfigInitParameters `json:"loggingConfig,omitempty" tf:"logging_config,omitempty"`
 
 	// A mapping of property names to values, used to configure Pig. Properties that conflict with values set by the Cloud Dataproc API may be overwritten. Can include properties set in /etc/hadoop/conf/*-site.xml, /etc/pig/conf/pig.properties, and classes in user code.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// HCFS URI of file containing Hive script to execute as the job.
@@ -378,18 +394,21 @@ type PigConfigInitParameters struct {
 	QueryList []*string `json:"queryList,omitempty" tf:"query_list,omitempty"`
 
 	// Mapping of query variable names to values (equivalent to the Pig command: name=[value]).
+	// +mapType=granular
 	ScriptVariables map[string]*string `json:"scriptVariables,omitempty" tf:"script_variables,omitempty"`
 }
 
 type PigConfigLoggingConfigInitParameters struct {
 
 	// The per-package log levels for the driver. This may include 'root' package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
 type PigConfigLoggingConfigObservation struct {
 
 	// The per-package log levels for the driver. This may include 'root' package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
@@ -397,6 +416,7 @@ type PigConfigLoggingConfigParameters struct {
 
 	// The per-package log levels for the driver. This may include 'root' package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels" tf:"driver_log_levels,omitempty"`
 }
 
@@ -411,6 +431,7 @@ type PigConfigObservation struct {
 	LoggingConfig []PigConfigLoggingConfigObservation `json:"loggingConfig,omitempty" tf:"logging_config,omitempty"`
 
 	// A mapping of property names to values, used to configure Pig. Properties that conflict with values set by the Cloud Dataproc API may be overwritten. Can include properties set in /etc/hadoop/conf/*-site.xml, /etc/pig/conf/pig.properties, and classes in user code.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// HCFS URI of file containing Hive script to execute as the job.
@@ -422,6 +443,7 @@ type PigConfigObservation struct {
 	QueryList []*string `json:"queryList,omitempty" tf:"query_list,omitempty"`
 
 	// Mapping of query variable names to values (equivalent to the Pig command: name=[value]).
+	// +mapType=granular
 	ScriptVariables map[string]*string `json:"scriptVariables,omitempty" tf:"script_variables,omitempty"`
 }
 
@@ -440,6 +462,7 @@ type PigConfigParameters struct {
 
 	// A mapping of property names to values, used to configure Pig. Properties that conflict with values set by the Cloud Dataproc API may be overwritten. Can include properties set in /etc/hadoop/conf/*-site.xml, /etc/pig/conf/pig.properties, and classes in user code.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// HCFS URI of file containing Hive script to execute as the job.
@@ -454,6 +477,7 @@ type PigConfigParameters struct {
 
 	// Mapping of query variable names to values (equivalent to the Pig command: name=[value]).
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	ScriptVariables map[string]*string `json:"scriptVariables,omitempty" tf:"script_variables,omitempty"`
 }
 
@@ -502,6 +526,7 @@ type PrestoConfigInitParameters struct {
 	OutputFormat *string `json:"outputFormat,omitempty" tf:"output_format,omitempty"`
 
 	// A mapping of property names to values. Used to set Presto session properties Equivalent to using the --session flag in the Presto CLI.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// The HCFS URI of the script that contains SQL queries.
@@ -516,12 +541,14 @@ type PrestoConfigInitParameters struct {
 type PrestoConfigLoggingConfigInitParameters struct {
 
 	// The per-package log levels for the driver. This may include 'root' package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
 type PrestoConfigLoggingConfigObservation struct {
 
 	// The per-package log levels for the driver. This may include 'root' package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
@@ -529,6 +556,7 @@ type PrestoConfigLoggingConfigParameters struct {
 
 	// The per-package log levels for the driver. This may include 'root' package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels" tf:"driver_log_levels,omitempty"`
 }
 
@@ -546,6 +574,7 @@ type PrestoConfigObservation struct {
 	OutputFormat *string `json:"outputFormat,omitempty" tf:"output_format,omitempty"`
 
 	// A mapping of property names to values. Used to set Presto session properties Equivalent to using the --session flag in the Presto CLI.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// The HCFS URI of the script that contains SQL queries.
@@ -576,6 +605,7 @@ type PrestoConfigParameters struct {
 
 	// A mapping of property names to values. Used to set Presto session properties Equivalent to using the --session flag in the Presto CLI.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// The HCFS URI of the script that contains SQL queries.
@@ -609,6 +639,7 @@ type PysparkConfigInitParameters struct {
 	MainPythonFileURI *string `json:"mainPythonFileUri,omitempty" tf:"main_python_file_uri,omitempty"`
 
 	// A mapping of property names to values, used to configure PySpark. Properties that conflict with values set by the Cloud Dataproc API may be overwritten. Can include properties set in /etc/spark/conf/spark-defaults.conf and classes in user code.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// HCFS file URIs of Python files to pass to the PySpark framework. Supported file types: .py, .egg, and .zip.
@@ -618,12 +649,14 @@ type PysparkConfigInitParameters struct {
 type PysparkConfigLoggingConfigInitParameters struct {
 
 	// The per-package log levels for the driver. This may include 'root' package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
 type PysparkConfigLoggingConfigObservation struct {
 
 	// The per-package log levels for the driver. This may include 'root' package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
@@ -631,6 +664,7 @@ type PysparkConfigLoggingConfigParameters struct {
 
 	// The per-package log levels for the driver. This may include 'root' package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels" tf:"driver_log_levels,omitempty"`
 }
 
@@ -654,6 +688,7 @@ type PysparkConfigObservation struct {
 	MainPythonFileURI *string `json:"mainPythonFileUri,omitempty" tf:"main_python_file_uri,omitempty"`
 
 	// A mapping of property names to values, used to configure PySpark. Properties that conflict with values set by the Cloud Dataproc API may be overwritten. Can include properties set in /etc/spark/conf/spark-defaults.conf and classes in user code.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// HCFS file URIs of Python files to pass to the PySpark framework. Supported file types: .py, .egg, and .zip.
@@ -687,6 +722,7 @@ type PysparkConfigParameters struct {
 
 	// A mapping of property names to values, used to configure PySpark. Properties that conflict with values set by the Cloud Dataproc API may be overwritten. Can include properties set in /etc/spark/conf/spark-defaults.conf and classes in user code.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// HCFS file URIs of Python files to pass to the PySpark framework. Supported file types: .py, .egg, and .zip.
@@ -762,18 +798,21 @@ type SparkConfigInitParameters struct {
 	MainJarFileURI *string `json:"mainJarFileUri,omitempty" tf:"main_jar_file_uri,omitempty"`
 
 	// A mapping of property names to values, used to configure Spark. Properties that conflict with values set by the Cloud Dataproc API may be overwritten. Can include properties set in /etc/spark/conf/spark-defaults.conf and classes in user code.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 }
 
 type SparkConfigLoggingConfigInitParameters struct {
 
 	// The per-package log levels for the driver. This may include 'root' package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
 type SparkConfigLoggingConfigObservation struct {
 
 	// The per-package log levels for the driver. This may include 'root' package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
@@ -781,6 +820,7 @@ type SparkConfigLoggingConfigParameters struct {
 
 	// The per-package log levels for the driver. This may include 'root' package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels" tf:"driver_log_levels,omitempty"`
 }
 
@@ -809,6 +849,7 @@ type SparkConfigObservation struct {
 	MainJarFileURI *string `json:"mainJarFileUri,omitempty" tf:"main_jar_file_uri,omitempty"`
 
 	// A mapping of property names to values, used to configure Spark. Properties that conflict with values set by the Cloud Dataproc API may be overwritten. Can include properties set in /etc/spark/conf/spark-defaults.conf and classes in user code.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 }
 
@@ -845,6 +886,7 @@ type SparkConfigParameters struct {
 
 	// A mapping of property names to values, used to configure Spark. Properties that conflict with values set by the Cloud Dataproc API may be overwritten. Can include properties set in /etc/spark/conf/spark-defaults.conf and classes in user code.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 }
 
@@ -856,6 +898,7 @@ type SparksqlConfigInitParameters struct {
 	LoggingConfig []SparksqlConfigLoggingConfigInitParameters `json:"loggingConfig,omitempty" tf:"logging_config,omitempty"`
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Cloud Dataproc API may be overwritten.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// The HCFS URI of the script that contains SQL queries.
@@ -867,18 +910,21 @@ type SparksqlConfigInitParameters struct {
 	QueryList []*string `json:"queryList,omitempty" tf:"query_list,omitempty"`
 
 	// Mapping of query variable names to values (equivalent to the Spark SQL command: SET name="value";).
+	// +mapType=granular
 	ScriptVariables map[string]*string `json:"scriptVariables,omitempty" tf:"script_variables,omitempty"`
 }
 
 type SparksqlConfigLoggingConfigInitParameters struct {
 
 	// The per-package log levels for the driver. This may include 'root' package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
 type SparksqlConfigLoggingConfigObservation struct {
 
 	// The per-package log levels for the driver. This may include 'root' package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
@@ -886,6 +932,7 @@ type SparksqlConfigLoggingConfigParameters struct {
 
 	// The per-package log levels for the driver. This may include 'root' package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels" tf:"driver_log_levels,omitempty"`
 }
 
@@ -897,6 +944,7 @@ type SparksqlConfigObservation struct {
 	LoggingConfig []SparksqlConfigLoggingConfigObservation `json:"loggingConfig,omitempty" tf:"logging_config,omitempty"`
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Cloud Dataproc API may be overwritten.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// The HCFS URI of the script that contains SQL queries.
@@ -908,6 +956,7 @@ type SparksqlConfigObservation struct {
 	QueryList []*string `json:"queryList,omitempty" tf:"query_list,omitempty"`
 
 	// Mapping of query variable names to values (equivalent to the Spark SQL command: SET name="value";).
+	// +mapType=granular
 	ScriptVariables map[string]*string `json:"scriptVariables,omitempty" tf:"script_variables,omitempty"`
 }
 
@@ -922,6 +971,7 @@ type SparksqlConfigParameters struct {
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Cloud Dataproc API may be overwritten.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// The HCFS URI of the script that contains SQL queries.
@@ -936,6 +986,7 @@ type SparksqlConfigParameters struct {
 
 	// Mapping of query variable names to values (equivalent to the Spark SQL command: SET name="value";).
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	ScriptVariables map[string]*string `json:"scriptVariables,omitempty" tf:"script_variables,omitempty"`
 }
 
diff --git a/apis/dataproc/v1beta1/zz_metastoreservice_types.go b/apis/dataproc/v1beta1/zz_metastoreservice_types.go
index 4f8096fd3..ffe35e6f7 100755
--- a/apis/dataproc/v1beta1/zz_metastoreservice_types.go
+++ b/apis/dataproc/v1beta1/zz_metastoreservice_types.go
@@ -69,6 +69,7 @@ type HiveMetastoreConfigInitParameters struct {
 
 	// A mapping of Hive metastore configuration key-value pairs to apply to the Hive metastore (configured in hive-site.xml).
 	// The mappings override system defaults (some keys cannot be overridden)
+	// +mapType=granular
 	ConfigOverrides map[string]*string `json:"configOverrides,omitempty" tf:"config_overrides,omitempty"`
 
 	// Information used to configure the Hive metastore service as a service principal in a Kerberos realm.
@@ -125,6 +126,7 @@ type HiveMetastoreConfigObservation struct {
 
 	// A mapping of Hive metastore configuration key-value pairs to apply to the Hive metastore (configured in hive-site.xml).
 	// The mappings override system defaults (some keys cannot be overridden)
+	// +mapType=granular
 	ConfigOverrides map[string]*string `json:"configOverrides,omitempty" tf:"config_overrides,omitempty"`
 
 	// Information used to configure the Hive metastore service as a service principal in a Kerberos realm.
@@ -140,6 +142,7 @@ type HiveMetastoreConfigParameters struct {
 	// A mapping of Hive metastore configuration key-value pairs to apply to the Hive metastore (configured in hive-site.xml).
 	// The mappings override system defaults (some keys cannot be overridden)
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	ConfigOverrides map[string]*string `json:"configOverrides,omitempty" tf:"config_overrides,omitempty"`
 
 	// Information used to configure the Hive metastore service as a service principal in a Kerberos realm.
@@ -251,6 +254,7 @@ type MetastoreServiceInitParameters struct {
 	HiveMetastoreConfig []HiveMetastoreConfigInitParameters `json:"hiveMetastoreConfig,omitempty" tf:"hive_metastore_config,omitempty"`
 
 	// User-defined labels for the metastore service.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The one hour maintenance window of the metastore service.
@@ -314,6 +318,7 @@ type MetastoreServiceObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// User-defined labels for the metastore service.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The location where the metastore service should reside.
@@ -388,6 +393,7 @@ type MetastoreServiceParameters struct {
 
 	// User-defined labels for the metastore service.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The location where the metastore service should reside.
diff --git a/apis/dataproc/v1beta1/zz_workflowtemplate_types.go b/apis/dataproc/v1beta1/zz_workflowtemplate_types.go
index 70dd20011..f782ba74c 100755
--- a/apis/dataproc/v1beta1/zz_workflowtemplate_types.go
+++ b/apis/dataproc/v1beta1/zz_workflowtemplate_types.go
@@ -32,6 +32,7 @@ import (
 type ClusterSelectorInitParameters struct {
 
 	// Required. The cluster labels. Cluster must have all labels to match.
+	// +mapType=granular
 	ClusterLabels map[string]*string `json:"clusterLabels,omitempty" tf:"cluster_labels,omitempty"`
 
 	// The zone where the Compute Engine cluster will be located. On a create request, it is required in the "global" region. If omitted in a non-global Dataproc region, the service will pick a zone in the corresponding Compute Engine region. On a get request, zone will always be present. A full URL, partial URI, or short name are valid. Examples: * https://www.googleapis.com/compute/v1/projects/ * us-central1-f
@@ -41,6 +42,7 @@ type ClusterSelectorInitParameters struct {
 type ClusterSelectorObservation struct {
 
 	// Required. The cluster labels. Cluster must have all labels to match.
+	// +mapType=granular
 	ClusterLabels map[string]*string `json:"clusterLabels,omitempty" tf:"cluster_labels,omitempty"`
 
 	// The zone where the Compute Engine cluster will be located. On a create request, it is required in the "global" region. If omitted in a non-global Dataproc region, the service will pick a zone in the corresponding Compute Engine region. On a get request, zone will always be present. A full URL, partial URI, or short name are valid. Examples: * https://www.googleapis.com/compute/v1/projects/ * us-central1-f
@@ -51,6 +53,7 @@ type ClusterSelectorParameters struct {
 
 	// Required. The cluster labels. Cluster must have all labels to match.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	ClusterLabels map[string]*string `json:"clusterLabels" tf:"cluster_labels,omitempty"`
 
 	// The zone where the Compute Engine cluster will be located. On a create request, it is required in the "global" region. If omitted in a non-global Dataproc region, the service will pick a zone in the corresponding Compute Engine region. On a get request, zone will always be present. A full URL, partial URI, or short name are valid. Examples: * https://www.googleapis.com/compute/v1/projects/ * us-central1-f
@@ -108,6 +111,7 @@ type ConfigEndpointConfigObservation struct {
 	EnableHTTPPortAccess *bool `json:"enableHttpPortAccess,omitempty" tf:"enable_http_port_access,omitempty"`
 
 	// Output only. The map of port descriptions to URLs. Will only be populated if enable_http_port_access is true.
+	// +mapType=granular
 	HTTPPorts map[string]*string `json:"httpPorts,omitempty" tf:"http_ports,omitempty"`
 }
 
@@ -124,6 +128,7 @@ type ConfigGceClusterConfigInitParameters struct {
 	InternalIPOnly *bool `json:"internalIpOnly,omitempty" tf:"internal_ip_only,omitempty"`
 
 	// The Compute Engine metadata entries to add to all instances (see (https://cloud.google.com/compute/docs/storing-retrieving-metadata#project_and_instance_metadata)).
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// The Compute Engine network to be used for machine communications. Cannot be specified with subnetwork_uri. If neither network_uri nor subnetwork_uri is specified, the "default" network of the project is used, if it exists. Cannot be a "Custom Subnet Network" (see /regions/global/default*default`
@@ -151,6 +156,7 @@ type ConfigGceClusterConfigInitParameters struct {
 	Subnetwork *string `json:"subnetwork,omitempty" tf:"subnetwork,omitempty"`
 
 	// The Compute Engine tags to add to all instances (see (https://cloud.google.com/compute/docs/label-or-tag-resources#tags)).
+	// +listType=set
 	Tags []*string `json:"tags,omitempty" tf:"tags,omitempty"`
 
 	// The zone where the Compute Engine cluster will be located. On a create request, it is required in the "global" region. If omitted in a non-global Dataproc region, the service will pick a zone in the corresponding Compute Engine region. On a get request, zone will always be present. A full URL, partial URI, or short name are valid. Examples: * https://www.googleapis.com/compute/v1/projects/ * us-central1-f
@@ -163,6 +169,7 @@ type ConfigGceClusterConfigObservation struct {
 	InternalIPOnly *bool `json:"internalIpOnly,omitempty" tf:"internal_ip_only,omitempty"`
 
 	// The Compute Engine metadata entries to add to all instances (see (https://cloud.google.com/compute/docs/storing-retrieving-metadata#project_and_instance_metadata)).
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// The Compute Engine network to be used for machine communications. Cannot be specified with subnetwork_uri. If neither network_uri nor subnetwork_uri is specified, the "default" network of the project is used, if it exists. Cannot be a "Custom Subnet Network" (see /regions/global/default*default`
@@ -190,6 +197,7 @@ type ConfigGceClusterConfigObservation struct {
 	Subnetwork *string `json:"subnetwork,omitempty" tf:"subnetwork,omitempty"`
 
 	// The Compute Engine tags to add to all instances (see (https://cloud.google.com/compute/docs/label-or-tag-resources#tags)).
+	// +listType=set
 	Tags []*string `json:"tags,omitempty" tf:"tags,omitempty"`
 
 	// The zone where the Compute Engine cluster will be located. On a create request, it is required in the "global" region. If omitted in a non-global Dataproc region, the service will pick a zone in the corresponding Compute Engine region. On a get request, zone will always be present. A full URL, partial URI, or short name are valid. Examples: * https://www.googleapis.com/compute/v1/projects/ * us-central1-f
@@ -204,6 +212,7 @@ type ConfigGceClusterConfigParameters struct {
 
 	// The Compute Engine metadata entries to add to all instances (see (https://cloud.google.com/compute/docs/storing-retrieving-metadata#project_and_instance_metadata)).
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// The Compute Engine network to be used for machine communications. Cannot be specified with subnetwork_uri. If neither network_uri nor subnetwork_uri is specified, the "default" network of the project is used, if it exists. Cannot be a "Custom Subnet Network" (see /regions/global/default*default`
@@ -240,6 +249,7 @@ type ConfigGceClusterConfigParameters struct {
 
 	// The Compute Engine tags to add to all instances (see (https://cloud.google.com/compute/docs/label-or-tag-resources#tags)).
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Tags []*string `json:"tags,omitempty" tf:"tags,omitempty"`
 
 	// The zone where the Compute Engine cluster will be located. On a create request, it is required in the "global" region. If omitted in a non-global Dataproc region, the service will pick a zone in the corresponding Compute Engine region. On a get request, zone will always be present. A full URL, partial URI, or short name are valid. Examples: * https://www.googleapis.com/compute/v1/projects/ * us-central1-f
@@ -493,6 +503,7 @@ type ConfigSoftwareConfigInitParameters struct {
 	OptionalComponents []*string `json:"optionalComponents,omitempty" tf:"optional_components,omitempty"`
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 }
 
@@ -505,6 +516,7 @@ type ConfigSoftwareConfigObservation struct {
 	OptionalComponents []*string `json:"optionalComponents,omitempty" tf:"optional_components,omitempty"`
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 }
 
@@ -520,6 +532,7 @@ type ConfigSoftwareConfigParameters struct {
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 }
 
@@ -800,18 +813,21 @@ type HadoopJobInitParameters struct {
 	MainJarFileURI *string `json:"mainJarFileUri,omitempty" tf:"main_jar_file_uri,omitempty"`
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 }
 
 type HadoopJobLoggingConfigInitParameters struct {
 
 	// The per-package log levels for the driver. This may include "root" package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
 type HadoopJobLoggingConfigObservation struct {
 
 	// The per-package log levels for the driver. This may include "root" package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
@@ -819,6 +835,7 @@ type HadoopJobLoggingConfigParameters struct {
 
 	// The per-package log levels for the driver. This may include "root" package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
@@ -846,6 +863,7 @@ type HadoopJobObservation struct {
 	MainJarFileURI *string `json:"mainJarFileUri,omitempty" tf:"main_jar_file_uri,omitempty"`
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 }
 
@@ -881,6 +899,7 @@ type HadoopJobParameters struct {
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 }
 
@@ -893,6 +912,7 @@ type HiveJobInitParameters struct {
 	JarFileUris []*string `json:"jarFileUris,omitempty" tf:"jar_file_uris,omitempty"`
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// The HCFS URI of the script that contains SQL queries.
@@ -902,6 +922,7 @@ type HiveJobInitParameters struct {
 	QueryList []QueryListInitParameters `json:"queryList,omitempty" tf:"query_list,omitempty"`
 
 	// Mapping of query variable names to values (equivalent to the Spark SQL command: SET name="value";).
+	// +mapType=granular
 	ScriptVariables map[string]*string `json:"scriptVariables,omitempty" tf:"script_variables,omitempty"`
 }
 
@@ -914,6 +935,7 @@ type HiveJobObservation struct {
 	JarFileUris []*string `json:"jarFileUris,omitempty" tf:"jar_file_uris,omitempty"`
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// The HCFS URI of the script that contains SQL queries.
@@ -923,6 +945,7 @@ type HiveJobObservation struct {
 	QueryList []QueryListObservation `json:"queryList,omitempty" tf:"query_list,omitempty"`
 
 	// Mapping of query variable names to values (equivalent to the Spark SQL command: SET name="value";).
+	// +mapType=granular
 	ScriptVariables map[string]*string `json:"scriptVariables,omitempty" tf:"script_variables,omitempty"`
 }
 
@@ -938,6 +961,7 @@ type HiveJobParameters struct {
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// The HCFS URI of the script that contains SQL queries.
@@ -950,6 +974,7 @@ type HiveJobParameters struct {
 
 	// Mapping of query variable names to values (equivalent to the Spark SQL command: SET name="value";).
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	ScriptVariables map[string]*string `json:"scriptVariables,omitempty" tf:"script_variables,omitempty"`
 }
 
@@ -991,6 +1016,7 @@ type JobsInitParameters struct {
 	HiveJob []HiveJobInitParameters `json:"hiveJob,omitempty" tf:"hive_job,omitempty"`
 
 	// The labels to associate with this job. Label keys must be between 1 and 63 characters long, and must conform to the following regular expression: {0,63} No more than 32 labels can be associated with a given job.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Job is a Pig job.
@@ -1030,6 +1056,7 @@ type JobsObservation struct {
 	HiveJob []HiveJobObservation `json:"hiveJob,omitempty" tf:"hive_job,omitempty"`
 
 	// The labels to associate with this job. Label keys must be between 1 and 63 characters long, and must conform to the following regular expression: {0,63} No more than 32 labels can be associated with a given job.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Job is a Pig job.
@@ -1072,6 +1099,7 @@ type JobsParameters struct {
 
 	// The labels to associate with this job. Label keys must be between 1 and 63 characters long, and must conform to the following regular expression: {0,63} No more than 32 labels can be associated with a given job.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Job is a Pig job.
@@ -1288,6 +1316,7 @@ type ManagedClusterInitParameters struct {
 	Config []ManagedClusterConfigInitParameters `json:"config,omitempty" tf:"config,omitempty"`
 
 	// The labels to associate with this cluster. Label keys must be between 1 and 63 characters long, and must conform to the following PCRE regular expression: {0,63} No more than 32 labels can be associated with a given cluster.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 }
 
@@ -1300,6 +1329,7 @@ type ManagedClusterObservation struct {
 	Config []ManagedClusterConfigObservation `json:"config,omitempty" tf:"config,omitempty"`
 
 	// The labels to associate with this cluster. Label keys must be between 1 and 63 characters long, and must conform to the following PCRE regular expression: {0,63} No more than 32 labels can be associated with a given cluster.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 }
 
@@ -1315,6 +1345,7 @@ type ManagedClusterParameters struct {
 
 	// The labels to associate with this cluster. Label keys must be between 1 and 63 characters long, and must conform to the following PCRE regular expression: {0,63} No more than 32 labels can be associated with a given cluster.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 }
 
@@ -1462,6 +1493,7 @@ type PigJobInitParameters struct {
 	LoggingConfig []PigJobLoggingConfigInitParameters `json:"loggingConfig,omitempty" tf:"logging_config,omitempty"`
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// The HCFS URI of the script that contains SQL queries.
@@ -1471,18 +1503,21 @@ type PigJobInitParameters struct {
 	QueryList []PigJobQueryListInitParameters `json:"queryList,omitempty" tf:"query_list,omitempty"`
 
 	// Mapping of query variable names to values (equivalent to the Spark SQL command: SET name="value";).
+	// +mapType=granular
 	ScriptVariables map[string]*string `json:"scriptVariables,omitempty" tf:"script_variables,omitempty"`
 }
 
 type PigJobLoggingConfigInitParameters struct {
 
 	// The per-package log levels for the driver. This may include "root" package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
 type PigJobLoggingConfigObservation struct {
 
 	// The per-package log levels for the driver. This may include "root" package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
@@ -1490,6 +1525,7 @@ type PigJobLoggingConfigParameters struct {
 
 	// The per-package log levels for the driver. This may include "root" package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
@@ -1505,6 +1541,7 @@ type PigJobObservation struct {
 	LoggingConfig []PigJobLoggingConfigObservation `json:"loggingConfig,omitempty" tf:"logging_config,omitempty"`
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// The HCFS URI of the script that contains SQL queries.
@@ -1514,6 +1551,7 @@ type PigJobObservation struct {
 	QueryList []PigJobQueryListObservation `json:"queryList,omitempty" tf:"query_list,omitempty"`
 
 	// Mapping of query variable names to values (equivalent to the Spark SQL command: SET name="value";).
+	// +mapType=granular
 	ScriptVariables map[string]*string `json:"scriptVariables,omitempty" tf:"script_variables,omitempty"`
 }
 
@@ -1533,6 +1571,7 @@ type PigJobParameters struct {
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// The HCFS URI of the script that contains SQL queries.
@@ -1545,6 +1584,7 @@ type PigJobParameters struct {
 
 	// Mapping of query variable names to values (equivalent to the Spark SQL command: SET name="value";).
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	ScriptVariables map[string]*string `json:"scriptVariables,omitempty" tf:"script_variables,omitempty"`
 }
 
@@ -1582,6 +1622,7 @@ type PrestoJobInitParameters struct {
 	OutputFormat *string `json:"outputFormat,omitempty" tf:"output_format,omitempty"`
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// The HCFS URI of the script that contains SQL queries.
@@ -1594,12 +1635,14 @@ type PrestoJobInitParameters struct {
 type PrestoJobLoggingConfigInitParameters struct {
 
 	// The per-package log levels for the driver. This may include "root" package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
 type PrestoJobLoggingConfigObservation struct {
 
 	// The per-package log levels for the driver. This may include "root" package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
@@ -1607,6 +1650,7 @@ type PrestoJobLoggingConfigParameters struct {
 
 	// The per-package log levels for the driver. This may include "root" package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
@@ -1625,6 +1669,7 @@ type PrestoJobObservation struct {
 	OutputFormat *string `json:"outputFormat,omitempty" tf:"output_format,omitempty"`
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// The HCFS URI of the script that contains SQL queries.
@@ -1654,6 +1699,7 @@ type PrestoJobParameters struct {
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// The HCFS URI of the script that contains SQL queries.
@@ -1705,6 +1751,7 @@ type PysparkJobInitParameters struct {
 	MainPythonFileURI *string `json:"mainPythonFileUri,omitempty" tf:"main_python_file_uri,omitempty"`
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// HCFS file URIs of Python files to pass to the PySpark framework. Supported file types: .py, .egg, and .zip.
@@ -1714,12 +1761,14 @@ type PysparkJobInitParameters struct {
 type PysparkJobLoggingConfigInitParameters struct {
 
 	// The per-package log levels for the driver. This may include "root" package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
 type PysparkJobLoggingConfigObservation struct {
 
 	// The per-package log levels for the driver. This may include "root" package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
@@ -1727,6 +1776,7 @@ type PysparkJobLoggingConfigParameters struct {
 
 	// The per-package log levels for the driver. This may include "root" package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
@@ -1751,6 +1801,7 @@ type PysparkJobObservation struct {
 	MainPythonFileURI *string `json:"mainPythonFileUri,omitempty" tf:"main_python_file_uri,omitempty"`
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// HCFS file URIs of Python files to pass to the PySpark framework. Supported file types: .py, .egg, and .zip.
@@ -1785,6 +1836,7 @@ type PysparkJobParameters struct {
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// HCFS file URIs of Python files to pass to the PySpark framework. Supported file types: .py, .egg, and .zip.
@@ -2096,18 +2148,21 @@ type SparkJobInitParameters struct {
 	MainJarFileURI *string `json:"mainJarFileUri,omitempty" tf:"main_jar_file_uri,omitempty"`
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 }
 
 type SparkJobLoggingConfigInitParameters struct {
 
 	// The per-package log levels for the driver. This may include "root" package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
 type SparkJobLoggingConfigObservation struct {
 
 	// The per-package log levels for the driver. This may include "root" package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
@@ -2115,6 +2170,7 @@ type SparkJobLoggingConfigParameters struct {
 
 	// The per-package log levels for the driver. This may include "root" package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
@@ -2142,6 +2198,7 @@ type SparkJobObservation struct {
 	MainJarFileURI *string `json:"mainJarFileUri,omitempty" tf:"main_jar_file_uri,omitempty"`
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 }
 
@@ -2177,6 +2234,7 @@ type SparkJobParameters struct {
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 }
 
@@ -2198,18 +2256,21 @@ type SparkRJobInitParameters struct {
 	MainRFileURI *string `json:"mainRFileUri,omitempty" tf:"main_r_file_uri,omitempty"`
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 }
 
 type SparkRJobLoggingConfigInitParameters struct {
 
 	// The per-package log levels for the driver. This may include "root" package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
 type SparkRJobLoggingConfigObservation struct {
 
 	// The per-package log levels for the driver. This may include "root" package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
@@ -2217,6 +2278,7 @@ type SparkRJobLoggingConfigParameters struct {
 
 	// The per-package log levels for the driver. This may include "root" package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
@@ -2238,6 +2300,7 @@ type SparkRJobObservation struct {
 	MainRFileURI *string `json:"mainRFileUri,omitempty" tf:"main_r_file_uri,omitempty"`
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 }
 
@@ -2265,6 +2328,7 @@ type SparkRJobParameters struct {
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 }
 
@@ -2277,6 +2341,7 @@ type SparkSQLJobInitParameters struct {
 	LoggingConfig []SparkSQLJobLoggingConfigInitParameters `json:"loggingConfig,omitempty" tf:"logging_config,omitempty"`
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// The HCFS URI of the script that contains SQL queries.
@@ -2286,18 +2351,21 @@ type SparkSQLJobInitParameters struct {
 	QueryList []SparkSQLJobQueryListInitParameters `json:"queryList,omitempty" tf:"query_list,omitempty"`
 
 	// Mapping of query variable names to values (equivalent to the Spark SQL command: SET name="value";).
+	// +mapType=granular
 	ScriptVariables map[string]*string `json:"scriptVariables,omitempty" tf:"script_variables,omitempty"`
 }
 
 type SparkSQLJobLoggingConfigInitParameters struct {
 
 	// The per-package log levels for the driver. This may include "root" package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
 type SparkSQLJobLoggingConfigObservation struct {
 
 	// The per-package log levels for the driver. This may include "root" package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
@@ -2305,6 +2373,7 @@ type SparkSQLJobLoggingConfigParameters struct {
 
 	// The per-package log levels for the driver. This may include "root" package name to configure rootLogger. Examples: 'com.google = FATAL', 'root = INFO', 'org.apache = DEBUG'
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	DriverLogLevels map[string]*string `json:"driverLogLevels,omitempty" tf:"driver_log_levels,omitempty"`
 }
 
@@ -2317,6 +2386,7 @@ type SparkSQLJobObservation struct {
 	LoggingConfig []SparkSQLJobLoggingConfigObservation `json:"loggingConfig,omitempty" tf:"logging_config,omitempty"`
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// The HCFS URI of the script that contains SQL queries.
@@ -2326,6 +2396,7 @@ type SparkSQLJobObservation struct {
 	QueryList []SparkSQLJobQueryListObservation `json:"queryList,omitempty" tf:"query_list,omitempty"`
 
 	// Mapping of query variable names to values (equivalent to the Spark SQL command: SET name="value";).
+	// +mapType=granular
 	ScriptVariables map[string]*string `json:"scriptVariables,omitempty" tf:"script_variables,omitempty"`
 }
 
@@ -2341,6 +2412,7 @@ type SparkSQLJobParameters struct {
 
 	// A mapping of property names to values, used to configure Spark SQL's SparkConf. Properties that conflict with values set by the Dataproc API may be overwritten.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Properties map[string]*string `json:"properties,omitempty" tf:"properties,omitempty"`
 
 	// The HCFS URI of the script that contains SQL queries.
@@ -2353,6 +2425,7 @@ type SparkSQLJobParameters struct {
 
 	// Mapping of query variable names to values (equivalent to the Spark SQL command: SET name="value";).
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	ScriptVariables map[string]*string `json:"scriptVariables,omitempty" tf:"script_variables,omitempty"`
 }
 
@@ -2447,6 +2520,7 @@ type WorkflowTemplateInitParameters struct {
 	Jobs []JobsInitParameters `json:"jobs,omitempty" tf:"jobs,omitempty"`
 
 	// The labels to associate with this cluster. Label keys must be between 1 and 63 characters long, and must conform to the following PCRE regular expression: {0,63} No more than 32 labels can be associated with a given cluster.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Template parameters whose values are substituted into the template. Values for parameters must be provided when the template is instantiated.
@@ -2477,6 +2551,7 @@ type WorkflowTemplateObservation struct {
 	Jobs []JobsObservation `json:"jobs,omitempty" tf:"jobs,omitempty"`
 
 	// The labels to associate with this cluster. Label keys must be between 1 and 63 characters long, and must conform to the following PCRE regular expression: {0,63} No more than 32 labels can be associated with a given cluster.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The location for the resource
@@ -2510,6 +2585,7 @@ type WorkflowTemplateParameters struct {
 
 	// The labels to associate with this cluster. Label keys must be between 1 and 63 characters long, and must conform to the following PCRE regular expression: {0,63} No more than 32 labels can be associated with a given cluster.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The location for the resource
diff --git a/apis/datastore/v1beta1/zz_generated_terraformed.go b/apis/datastore/v1beta1/zz_generated_terraformed.go
index 1be70d416..6475b63ae 100755
--- a/apis/datastore/v1beta1/zz_generated_terraformed.go
+++ b/apis/datastore/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Index) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Index
+func (tr *Index) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Index using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Index) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/datastream/v1beta1/zz_connectionprofile_types.go b/apis/datastream/v1beta1/zz_connectionprofile_types.go
index 726f84853..2117077f7 100755
--- a/apis/datastream/v1beta1/zz_connectionprofile_types.go
+++ b/apis/datastream/v1beta1/zz_connectionprofile_types.go
@@ -55,6 +55,7 @@ type ConnectionProfileInitParameters struct {
 	GcsProfile []GcsProfileInitParameters `json:"gcsProfile,omitempty" tf:"gcs_profile,omitempty"`
 
 	// Labels.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// MySQL database profile.
@@ -98,6 +99,7 @@ type ConnectionProfileObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// Labels.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The name of the location this connection profile is located in.
@@ -149,6 +151,7 @@ type ConnectionProfileParameters struct {
 
 	// Labels.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The name of the location this connection profile is located in.
@@ -319,6 +322,7 @@ type MySQLProfileParameters struct {
 type OracleProfileInitParameters struct {
 
 	// Connection string attributes
+	// +mapType=granular
 	ConnectionAttributes map[string]*string `json:"connectionAttributes,omitempty" tf:"connection_attributes,omitempty"`
 
 	// Database for the Oracle connection.
@@ -337,6 +341,7 @@ type OracleProfileInitParameters struct {
 type OracleProfileObservation struct {
 
 	// Connection string attributes
+	// +mapType=granular
 	ConnectionAttributes map[string]*string `json:"connectionAttributes,omitempty" tf:"connection_attributes,omitempty"`
 
 	// Database for the Oracle connection.
@@ -356,6 +361,7 @@ type OracleProfileParameters struct {
 
 	// Connection string attributes
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	ConnectionAttributes map[string]*string `json:"connectionAttributes,omitempty" tf:"connection_attributes,omitempty"`
 
 	// Database for the Oracle connection.
diff --git a/apis/datastream/v1beta1/zz_generated_terraformed.go b/apis/datastream/v1beta1/zz_generated_terraformed.go
index c85387e9d..2a67f3093 100755
--- a/apis/datastream/v1beta1/zz_generated_terraformed.go
+++ b/apis/datastream/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *ConnectionProfile) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ConnectionProfile
+func (tr *ConnectionProfile) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ConnectionProfile using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ConnectionProfile) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *PrivateConnection) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this PrivateConnection
+func (tr *PrivateConnection) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this PrivateConnection using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *PrivateConnection) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/datastream/v1beta1/zz_privateconnection_types.go b/apis/datastream/v1beta1/zz_privateconnection_types.go
index a68aa3ccb..c1dab1607 100755
--- a/apis/datastream/v1beta1/zz_privateconnection_types.go
+++ b/apis/datastream/v1beta1/zz_privateconnection_types.go
@@ -35,6 +35,7 @@ type ErrorInitParameters struct {
 type ErrorObservation struct {
 
 	// A list of messages that carry the error details.
+	// +mapType=granular
 	Details map[string]*string `json:"details,omitempty" tf:"details,omitempty"`
 
 	// A message containing more information about the error that occurred.
@@ -50,6 +51,7 @@ type PrivateConnectionInitParameters struct {
 	DisplayName *string `json:"displayName,omitempty" tf:"display_name,omitempty"`
 
 	// Labels.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -75,6 +77,7 @@ type PrivateConnectionObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// Labels.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The name of the location this private connection is located in.
@@ -104,6 +107,7 @@ type PrivateConnectionParameters struct {
 
 	// Labels.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The name of the location this private connection is located in.
diff --git a/apis/dialogflowcx/v1beta1/zz_generated_terraformed.go b/apis/dialogflowcx/v1beta1/zz_generated_terraformed.go
index 685c5e709..e6ed892e6 100755
--- a/apis/dialogflowcx/v1beta1/zz_generated_terraformed.go
+++ b/apis/dialogflowcx/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Agent) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Agent
+func (tr *Agent) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Agent using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Agent) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *EntityType) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this EntityType
+func (tr *EntityType) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this EntityType using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *EntityType) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *Environment) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Environment
+func (tr *Environment) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Environment using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Environment) LateInitialize(attrs []byte) (bool, error) {
@@ -347,6 +438,36 @@ func (tr *Flow) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Flow
+func (tr *Flow) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Flow using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Flow) LateInitialize(attrs []byte) (bool, error) {
@@ -431,6 +552,36 @@ func (tr *Intent) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Intent
+func (tr *Intent) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Intent using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Intent) LateInitialize(attrs []byte) (bool, error) {
@@ -515,6 +666,36 @@ func (tr *Page) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Page
+func (tr *Page) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Page using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Page) LateInitialize(attrs []byte) (bool, error) {
@@ -599,6 +780,36 @@ func (tr *Version) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Version
+func (tr *Version) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Version using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Version) LateInitialize(attrs []byte) (bool, error) {
@@ -683,6 +894,36 @@ func (tr *Webhook) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Webhook
+func (tr *Webhook) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Webhook using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Webhook) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/dialogflowcx/v1beta1/zz_intent_types.go b/apis/dialogflowcx/v1beta1/zz_intent_types.go
index c5ca1d90c..984ab19e6 100755
--- a/apis/dialogflowcx/v1beta1/zz_intent_types.go
+++ b/apis/dialogflowcx/v1beta1/zz_intent_types.go
@@ -44,6 +44,7 @@ type IntentInitParameters struct {
 	// The key/value metadata to label an intent. Labels can contain lowercase letters, digits and the symbols '-' and '_'. International characters are allowed, including letters from unicase alphabets. Keys must start with a letter. Keys and values can be no longer than 63 characters and no more than 128 bytes.
 	// Prefix "sys-" is reserved for Dialogflow defined labels. Currently allowed Dialogflow defined labels include: * sys-head * sys-contextual The above labels do not require value. "sys-head" means the intent is a head intent. "sys.contextual" means the intent is a contextual intent.
 	// An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The language of the following fields in intent:
@@ -83,6 +84,7 @@ type IntentObservation struct {
 	// The key/value metadata to label an intent. Labels can contain lowercase letters, digits and the symbols '-' and '_'. International characters are allowed, including letters from unicase alphabets. Keys must start with a letter. Keys and values can be no longer than 63 characters and no more than 128 bytes.
 	// Prefix "sys-" is reserved for Dialogflow defined labels. Currently allowed Dialogflow defined labels include: * sys-head * sys-contextual The above labels do not require value. "sys-head" means the intent is a head intent. "sys.contextual" means the intent is a contextual intent.
 	// An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The language of the following fields in intent:
@@ -131,6 +133,7 @@ type IntentParameters struct {
 	// Prefix "sys-" is reserved for Dialogflow defined labels. Currently allowed Dialogflow defined labels include: * sys-head * sys-contextual The above labels do not require value. "sys-head" means the intent is a head intent. "sys.contextual" means the intent is a contextual intent.
 	// An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The language of the following fields in intent:
diff --git a/apis/dialogflowcx/v1beta1/zz_webhook_types.go b/apis/dialogflowcx/v1beta1/zz_webhook_types.go
index 84b008da4..5a6132807 100755
--- a/apis/dialogflowcx/v1beta1/zz_webhook_types.go
+++ b/apis/dialogflowcx/v1beta1/zz_webhook_types.go
@@ -35,6 +35,7 @@ type GenericWebServiceInitParameters struct {
 	AllowedCACerts []*string `json:"allowedCaCerts,omitempty" tf:"allowed_ca_certs,omitempty"`
 
 	// The HTTP request headers to send together with webhook requests.
+	// +mapType=granular
 	RequestHeaders map[string]*string `json:"requestHeaders,omitempty" tf:"request_headers,omitempty"`
 
 	// Whether to use speech adaptation for speech recognition.
@@ -47,6 +48,7 @@ type GenericWebServiceObservation struct {
 	AllowedCACerts []*string `json:"allowedCaCerts,omitempty" tf:"allowed_ca_certs,omitempty"`
 
 	// The HTTP request headers to send together with webhook requests.
+	// +mapType=granular
 	RequestHeaders map[string]*string `json:"requestHeaders,omitempty" tf:"request_headers,omitempty"`
 
 	// Whether to use speech adaptation for speech recognition.
@@ -61,6 +63,7 @@ type GenericWebServiceParameters struct {
 
 	// The HTTP request headers to send together with webhook requests.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	RequestHeaders map[string]*string `json:"requestHeaders,omitempty" tf:"request_headers,omitempty"`
 
 	// Whether to use speech adaptation for speech recognition.
@@ -74,6 +77,7 @@ type ServiceDirectoryGenericWebServiceInitParameters struct {
 	AllowedCACerts []*string `json:"allowedCaCerts,omitempty" tf:"allowed_ca_certs,omitempty"`
 
 	// The HTTP request headers to send together with webhook requests.
+	// +mapType=granular
 	RequestHeaders map[string]*string `json:"requestHeaders,omitempty" tf:"request_headers,omitempty"`
 
 	// Whether to use speech adaptation for speech recognition.
@@ -86,6 +90,7 @@ type ServiceDirectoryGenericWebServiceObservation struct {
 	AllowedCACerts []*string `json:"allowedCaCerts,omitempty" tf:"allowed_ca_certs,omitempty"`
 
 	// The HTTP request headers to send together with webhook requests.
+	// +mapType=granular
 	RequestHeaders map[string]*string `json:"requestHeaders,omitempty" tf:"request_headers,omitempty"`
 
 	// Whether to use speech adaptation for speech recognition.
@@ -100,6 +105,7 @@ type ServiceDirectoryGenericWebServiceParameters struct {
 
 	// The HTTP request headers to send together with webhook requests.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	RequestHeaders map[string]*string `json:"requestHeaders,omitempty" tf:"request_headers,omitempty"`
 
 	// Whether to use speech adaptation for speech recognition.
diff --git a/apis/dns/v1beta1/zz_generated_terraformed.go b/apis/dns/v1beta1/zz_generated_terraformed.go
index f3809e593..7a8b26e3f 100755
--- a/apis/dns/v1beta1/zz_generated_terraformed.go
+++ b/apis/dns/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *ManagedZone) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ManagedZone
+func (tr *ManagedZone) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ManagedZone using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ManagedZone) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *ManagedZoneIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ManagedZoneIAMMember
+func (tr *ManagedZoneIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ManagedZoneIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ManagedZoneIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *Policy) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Policy
+func (tr *Policy) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Policy using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Policy) LateInitialize(attrs []byte) (bool, error) {
@@ -347,6 +438,36 @@ func (tr *RecordSet) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this RecordSet
+func (tr *RecordSet) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this RecordSet using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *RecordSet) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/dns/v1beta1/zz_managedzone_types.go b/apis/dns/v1beta1/zz_managedzone_types.go
index 27352ce55..4d525826f 100755
--- a/apis/dns/v1beta1/zz_managedzone_types.go
+++ b/apis/dns/v1beta1/zz_managedzone_types.go
@@ -272,6 +272,7 @@ type ManagedZoneInitParameters struct {
 	ForwardingConfig []ForwardingConfigInitParameters `json:"forwardingConfig,omitempty" tf:"forwarding_config,omitempty"`
 
 	// A set of key/value label pairs to assign to this ManagedZone.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The presence of this field indicates that DNS Peering is enabled for this
@@ -328,6 +329,7 @@ type ManagedZoneObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// A set of key/value label pairs to assign to this ManagedZone.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Unique identifier for the resource; defined by the server.
@@ -391,6 +393,7 @@ type ManagedZoneParameters struct {
 
 	// A set of key/value label pairs to assign to this ManagedZone.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The presence of this field indicates that DNS Peering is enabled for this
diff --git a/apis/documentai/v1beta1/zz_generated_terraformed.go b/apis/documentai/v1beta1/zz_generated_terraformed.go
index 25c11ac01..8e6716567 100755
--- a/apis/documentai/v1beta1/zz_generated_terraformed.go
+++ b/apis/documentai/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Processor) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Processor
+func (tr *Processor) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Processor using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Processor) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/essentialcontacts/v1beta1/zz_generated_terraformed.go b/apis/essentialcontacts/v1beta1/zz_generated_terraformed.go
index 9c1d6462b..09d85fee2 100755
--- a/apis/essentialcontacts/v1beta1/zz_generated_terraformed.go
+++ b/apis/essentialcontacts/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Contact) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Contact
+func (tr *Contact) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Contact using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Contact) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/eventarc/v1beta1/zz_generated_terraformed.go b/apis/eventarc/v1beta1/zz_generated_terraformed.go
index 5bdc444af..3ab813658 100755
--- a/apis/eventarc/v1beta1/zz_generated_terraformed.go
+++ b/apis/eventarc/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Channel) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Channel
+func (tr *Channel) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Channel using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Channel) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *GoogleChannelConfig) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this GoogleChannelConfig
+func (tr *GoogleChannelConfig) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this GoogleChannelConfig using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *GoogleChannelConfig) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *Trigger) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Trigger
+func (tr *Trigger) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Trigger using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Trigger) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/eventarc/v1beta1/zz_trigger_types.go b/apis/eventarc/v1beta1/zz_trigger_types.go
index 5490d002e..b267349ce 100755
--- a/apis/eventarc/v1beta1/zz_trigger_types.go
+++ b/apis/eventarc/v1beta1/zz_trigger_types.go
@@ -270,6 +270,7 @@ type TriggerInitParameters struct {
 	EventDataContentType *string `json:"eventDataContentType,omitempty" tf:"event_data_content_type,omitempty"`
 
 	// Optional. User labels attached to the triggers that can be used to group resources.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Required. null The list of filters that applies to event attributes. Only events that match all the provided filters will be sent to the destination.
@@ -291,6 +292,7 @@ type TriggerObservation struct {
 	Channel *string `json:"channel,omitempty" tf:"channel,omitempty"`
 
 	// Output only. The reason(s) why a trigger is in FAILED state.
+	// +mapType=granular
 	Conditions map[string]*string `json:"conditions,omitempty" tf:"conditions,omitempty"`
 
 	// Output only. The creation time.
@@ -308,6 +310,7 @@ type TriggerObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// Optional. User labels attached to the triggers that can be used to group resources.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The location for the resource
@@ -347,6 +350,7 @@ type TriggerParameters struct {
 
 	// Optional. User labels attached to the triggers that can be used to group resources.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The location for the resource
diff --git a/apis/filestore/v1beta1/zz_backup_types.go b/apis/filestore/v1beta1/zz_backup_types.go
index 347b4530f..4541ce4e2 100755
--- a/apis/filestore/v1beta1/zz_backup_types.go
+++ b/apis/filestore/v1beta1/zz_backup_types.go
@@ -35,6 +35,7 @@ type BackupInitParameters struct {
 	Description *string `json:"description,omitempty" tf:"description,omitempty"`
 
 	// Resource labels to represent user-provided metadata.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -66,6 +67,7 @@ type BackupObservation struct {
 	KMSKeyName *string `json:"kmsKeyName,omitempty" tf:"kms_key_name,omitempty"`
 
 	// Resource labels to represent user-provided metadata.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The name of the location of the instance. This can be a region for ENTERPRISE tier instances.
@@ -99,6 +101,7 @@ type BackupParameters struct {
 
 	// Resource labels to represent user-provided metadata.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The name of the location of the instance. This can be a region for ENTERPRISE tier instances.
diff --git a/apis/filestore/v1beta1/zz_generated_terraformed.go b/apis/filestore/v1beta1/zz_generated_terraformed.go
index ca778eeda..7a9faca95 100755
--- a/apis/filestore/v1beta1/zz_generated_terraformed.go
+++ b/apis/filestore/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Backup) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Backup
+func (tr *Backup) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Backup using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Backup) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *Instance) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Instance
+func (tr *Instance) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Instance using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Instance) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *Snapshot) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Snapshot
+func (tr *Snapshot) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Snapshot using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Snapshot) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/filestore/v1beta1/zz_instance_types.go b/apis/filestore/v1beta1/zz_instance_types.go
index aef9a9aa9..43ea48d2f 100755
--- a/apis/filestore/v1beta1/zz_instance_types.go
+++ b/apis/filestore/v1beta1/zz_instance_types.go
@@ -91,6 +91,7 @@ type InstanceInitParameters struct {
 	FileShares []FileSharesInitParameters `json:"fileShares,omitempty" tf:"file_shares,omitempty"`
 
 	// Resource labels to represent user-provided metadata.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// VPC networks to which the instance is connected. For this version,
@@ -134,6 +135,7 @@ type InstanceObservation struct {
 	KMSKeyName *string `json:"kmsKeyName,omitempty" tf:"kms_key_name,omitempty"`
 
 	// Resource labels to represent user-provided metadata.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The name of the location of the instance. This can be a region for ENTERPRISE tier instances.
@@ -184,6 +186,7 @@ type InstanceParameters struct {
 
 	// Resource labels to represent user-provided metadata.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The name of the location of the instance. This can be a region for ENTERPRISE tier instances.
diff --git a/apis/filestore/v1beta1/zz_snapshot_types.go b/apis/filestore/v1beta1/zz_snapshot_types.go
index 5ced08ca0..2004f0a74 100755
--- a/apis/filestore/v1beta1/zz_snapshot_types.go
+++ b/apis/filestore/v1beta1/zz_snapshot_types.go
@@ -35,6 +35,7 @@ type SnapshotInitParameters struct {
 	Description *string `json:"description,omitempty" tf:"description,omitempty"`
 
 	// Resource labels to represent user-provided metadata.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -60,6 +61,7 @@ type SnapshotObservation struct {
 	Instance *string `json:"instance,omitempty" tf:"instance,omitempty"`
 
 	// Resource labels to represent user-provided metadata.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The name of the location of the instance. This can be a region for ENTERPRISE tier instances.
@@ -94,6 +96,7 @@ type SnapshotParameters struct {
 
 	// Resource labels to represent user-provided metadata.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The name of the location of the instance. This can be a region for ENTERPRISE tier instances.
diff --git a/apis/firebaserules/v1beta1/zz_generated_terraformed.go b/apis/firebaserules/v1beta1/zz_generated_terraformed.go
index 4d1153af3..68dcd428a 100755
--- a/apis/firebaserules/v1beta1/zz_generated_terraformed.go
+++ b/apis/firebaserules/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Release) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Release
+func (tr *Release) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Release using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Release) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *Ruleset) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Ruleset
+func (tr *Ruleset) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Ruleset using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Ruleset) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/gke/v1beta1/zz_backupbackupplan_types.go b/apis/gke/v1beta1/zz_backupbackupplan_types.go
index 70d913d9f..831f70282 100755
--- a/apis/gke/v1beta1/zz_backupbackupplan_types.go
+++ b/apis/gke/v1beta1/zz_backupbackupplan_types.go
@@ -51,6 +51,7 @@ type BackupBackupPlanInitParameters struct {
 	// Description: A set of custom labels supplied by the user.
 	// A list of key->value pairs.
 	// Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -98,6 +99,7 @@ type BackupBackupPlanObservation struct {
 	// Description: A set of custom labels supplied by the user.
 	// A list of key->value pairs.
 	// Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The region of the Backup Plan.
@@ -165,6 +167,7 @@ type BackupBackupPlanParameters struct {
 	// A list of key->value pairs.
 	// Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The region of the Backup Plan.
diff --git a/apis/gke/v1beta1/zz_generated_terraformed.go b/apis/gke/v1beta1/zz_generated_terraformed.go
index 893f09acc..8f1095a94 100755
--- a/apis/gke/v1beta1/zz_generated_terraformed.go
+++ b/apis/gke/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *BackupBackupPlan) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this BackupBackupPlan
+func (tr *BackupBackupPlan) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this BackupBackupPlan using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *BackupBackupPlan) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/gkehub/v1beta1/zz_generated_terraformed.go b/apis/gkehub/v1beta1/zz_generated_terraformed.go
index b0ab84c1a..67cc6f034 100755
--- a/apis/gkehub/v1beta1/zz_generated_terraformed.go
+++ b/apis/gkehub/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Membership) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Membership
+func (tr *Membership) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Membership using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Membership) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *MembershipIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this MembershipIAMMember
+func (tr *MembershipIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this MembershipIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *MembershipIAMMember) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/gkehub/v1beta1/zz_membership_types.go b/apis/gkehub/v1beta1/zz_membership_types.go
index 69c8d21fb..cd1c84d04 100755
--- a/apis/gkehub/v1beta1/zz_membership_types.go
+++ b/apis/gkehub/v1beta1/zz_membership_types.go
@@ -118,6 +118,7 @@ type MembershipInitParameters struct {
 	Endpoint []EndpointInitParameters `json:"endpoint,omitempty" tf:"endpoint,omitempty"`
 
 	// Labels to apply to this membership.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -141,6 +142,7 @@ type MembershipObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// Labels to apply to this membership.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The unique identifier of the membership.
@@ -167,6 +169,7 @@ type MembershipParameters struct {
 
 	// Labels to apply to this membership.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
diff --git a/apis/healthcare/v1beta1/zz_consentstore_types.go b/apis/healthcare/v1beta1/zz_consentstore_types.go
index e40b63fe7..120293f21 100755
--- a/apis/healthcare/v1beta1/zz_consentstore_types.go
+++ b/apis/healthcare/v1beta1/zz_consentstore_types.go
@@ -46,6 +46,7 @@ type ConsentStoreInitParameters struct {
 	// No more than 64 labels can be associated with a given store.
 	// An object containing a list of "key": value pairs.
 	// Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The name of this ConsentStore, for example:
@@ -77,6 +78,7 @@ type ConsentStoreObservation struct {
 	// No more than 64 labels can be associated with a given store.
 	// An object containing a list of "key": value pairs.
 	// Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The name of this ConsentStore, for example:
@@ -119,6 +121,7 @@ type ConsentStoreParameters struct {
 	// An object containing a list of "key": value pairs.
 	// Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The name of this ConsentStore, for example:
diff --git a/apis/healthcare/v1beta1/zz_generated_terraformed.go b/apis/healthcare/v1beta1/zz_generated_terraformed.go
index 796354eaa..fc2005292 100755
--- a/apis/healthcare/v1beta1/zz_generated_terraformed.go
+++ b/apis/healthcare/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *ConsentStore) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ConsentStore
+func (tr *ConsentStore) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ConsentStore using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ConsentStore) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *Dataset) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Dataset
+func (tr *Dataset) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Dataset using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Dataset) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *DatasetIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this DatasetIAMMember
+func (tr *DatasetIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this DatasetIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *DatasetIAMMember) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/iam/v1beta1/zz_generated_terraformed.go b/apis/iam/v1beta1/zz_generated_terraformed.go
index aa8ef7332..8f7bb37db 100755
--- a/apis/iam/v1beta1/zz_generated_terraformed.go
+++ b/apis/iam/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *WorkloadIdentityPool) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this WorkloadIdentityPool
+func (tr *WorkloadIdentityPool) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this WorkloadIdentityPool using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *WorkloadIdentityPool) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *WorkloadIdentityPoolProvider) GetInitParameters() (map[string]any, err
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this WorkloadIdentityPoolProvider
+func (tr *WorkloadIdentityPoolProvider) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this WorkloadIdentityPoolProvider using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *WorkloadIdentityPoolProvider) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/iam/v1beta1/zz_workloadidentitypoolprovider_types.go b/apis/iam/v1beta1/zz_workloadidentitypoolprovider_types.go
index 2153a0156..231befd81 100755
--- a/apis/iam/v1beta1/zz_workloadidentitypoolprovider_types.go
+++ b/apis/iam/v1beta1/zz_workloadidentitypoolprovider_types.go
@@ -133,6 +133,7 @@ type WorkloadIdentityPoolProviderInitParameters struct {
 	// to Google Cloud attributes, such as subject and segment.
 	// Each key must be a string specifying the Google Cloud IAM attribute to map to.
 	// The following keys are supported:
+	// +mapType=granular
 	AttributeMapping map[string]*string `json:"attributeMapping,omitempty" tf:"attribute_mapping,omitempty"`
 
 	// An Amazon Web Services identity provider. Not compatible with the property oidc.
@@ -171,6 +172,7 @@ type WorkloadIdentityPoolProviderObservation struct {
 	// to Google Cloud attributes, such as subject and segment.
 	// Each key must be a string specifying the Google Cloud IAM attribute to map to.
 	// The following keys are supported:
+	// +mapType=granular
 	AttributeMapping map[string]*string `json:"attributeMapping,omitempty" tf:"attribute_mapping,omitempty"`
 
 	// An Amazon Web Services identity provider. Not compatible with the property oidc.
@@ -226,6 +228,7 @@ type WorkloadIdentityPoolProviderParameters struct {
 	// Each key must be a string specifying the Google Cloud IAM attribute to map to.
 	// The following keys are supported:
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	AttributeMapping map[string]*string `json:"attributeMapping,omitempty" tf:"attribute_mapping,omitempty"`
 
 	// An Amazon Web Services identity provider. Not compatible with the property oidc.
diff --git a/apis/iap/v1beta1/zz_generated_terraformed.go b/apis/iap/v1beta1/zz_generated_terraformed.go
index 9099b7fd4..1f3ba063f 100755
--- a/apis/iap/v1beta1/zz_generated_terraformed.go
+++ b/apis/iap/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *AppEngineServiceIAMMember) GetInitParameters() (map[string]any, error)
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this AppEngineServiceIAMMember
+func (tr *AppEngineServiceIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this AppEngineServiceIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *AppEngineServiceIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *AppEngineVersionIAMMember) GetInitParameters() (map[string]any, error)
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this AppEngineVersionIAMMember
+func (tr *AppEngineVersionIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this AppEngineVersionIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *AppEngineVersionIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *TunnelIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this TunnelIAMMember
+func (tr *TunnelIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this TunnelIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *TunnelIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -347,6 +438,36 @@ func (tr *WebBackendServiceIAMMember) GetInitParameters() (map[string]any, error
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this WebBackendServiceIAMMember
+func (tr *WebBackendServiceIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this WebBackendServiceIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *WebBackendServiceIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -431,6 +552,36 @@ func (tr *WebIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this WebIAMMember
+func (tr *WebIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this WebIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *WebIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -515,6 +666,36 @@ func (tr *WebTypeAppEngineIAMMember) GetInitParameters() (map[string]any, error)
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this WebTypeAppEngineIAMMember
+func (tr *WebTypeAppEngineIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this WebTypeAppEngineIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *WebTypeAppEngineIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -599,6 +780,36 @@ func (tr *WebTypeComputeIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this WebTypeComputeIAMMember
+func (tr *WebTypeComputeIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this WebTypeComputeIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *WebTypeComputeIAMMember) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/identityplatform/v1beta1/zz_generated_terraformed.go b/apis/identityplatform/v1beta1/zz_generated_terraformed.go
index 63b321cdb..2ddbfe82e 100755
--- a/apis/identityplatform/v1beta1/zz_generated_terraformed.go
+++ b/apis/identityplatform/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *DefaultSupportedIdPConfig) GetInitParameters() (map[string]any, error)
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this DefaultSupportedIdPConfig
+func (tr *DefaultSupportedIdPConfig) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this DefaultSupportedIdPConfig using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *DefaultSupportedIdPConfig) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *InboundSAMLConfig) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this InboundSAMLConfig
+func (tr *InboundSAMLConfig) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this InboundSAMLConfig using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *InboundSAMLConfig) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *OAuthIdPConfig) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this OAuthIdPConfig
+func (tr *OAuthIdPConfig) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this OAuthIdPConfig using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *OAuthIdPConfig) LateInitialize(attrs []byte) (bool, error) {
@@ -347,6 +438,36 @@ func (tr *ProjectDefaultConfig) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ProjectDefaultConfig
+func (tr *ProjectDefaultConfig) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ProjectDefaultConfig using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ProjectDefaultConfig) LateInitialize(attrs []byte) (bool, error) {
@@ -431,6 +552,36 @@ func (tr *Tenant) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Tenant
+func (tr *Tenant) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Tenant using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Tenant) LateInitialize(attrs []byte) (bool, error) {
@@ -515,6 +666,36 @@ func (tr *TenantDefaultSupportedIdPConfig) GetInitParameters() (map[string]any,
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this TenantDefaultSupportedIdPConfig
+func (tr *TenantDefaultSupportedIdPConfig) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this TenantDefaultSupportedIdPConfig using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *TenantDefaultSupportedIdPConfig) LateInitialize(attrs []byte) (bool, error) {
@@ -599,6 +780,36 @@ func (tr *TenantInboundSAMLConfig) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this TenantInboundSAMLConfig
+func (tr *TenantInboundSAMLConfig) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this TenantInboundSAMLConfig using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *TenantInboundSAMLConfig) LateInitialize(attrs []byte) (bool, error) {
@@ -683,6 +894,36 @@ func (tr *TenantOAuthIdPConfig) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this TenantOAuthIdPConfig
+func (tr *TenantOAuthIdPConfig) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this TenantOAuthIdPConfig using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *TenantOAuthIdPConfig) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/identityplatform/v1beta1/zz_projectdefaultconfig_types.go b/apis/identityplatform/v1beta1/zz_projectdefaultconfig_types.go
index 7a232d2f2..612009149 100755
--- a/apis/identityplatform/v1beta1/zz_projectdefaultconfig_types.go
+++ b/apis/identityplatform/v1beta1/zz_projectdefaultconfig_types.go
@@ -118,6 +118,7 @@ type PhoneNumberInitParameters struct {
 	Enabled *bool `json:"enabled,omitempty" tf:"enabled,omitempty"`
 
 	// A map of <test phone number, fake code> that can be used for phone auth testing.
+	// +mapType=granular
 	TestPhoneNumbers map[string]*string `json:"testPhoneNumbers,omitempty" tf:"test_phone_numbers,omitempty"`
 }
 
@@ -127,6 +128,7 @@ type PhoneNumberObservation struct {
 	Enabled *bool `json:"enabled,omitempty" tf:"enabled,omitempty"`
 
 	// A map of <test phone number, fake code> that can be used for phone auth testing.
+	// +mapType=granular
 	TestPhoneNumbers map[string]*string `json:"testPhoneNumbers,omitempty" tf:"test_phone_numbers,omitempty"`
 }
 
@@ -138,6 +140,7 @@ type PhoneNumberParameters struct {
 
 	// A map of <test phone number, fake code> that can be used for phone auth testing.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	TestPhoneNumbers map[string]*string `json:"testPhoneNumbers,omitempty" tf:"test_phone_numbers,omitempty"`
 }
 
diff --git a/apis/kms/v1beta1/zz_cryptokey_types.go b/apis/kms/v1beta1/zz_cryptokey_types.go
index 9267269cc..ba3a530e1 100755
--- a/apis/kms/v1beta1/zz_cryptokey_types.go
+++ b/apis/kms/v1beta1/zz_cryptokey_types.go
@@ -39,6 +39,7 @@ type CryptoKeyInitParameters struct {
 	ImportOnly *bool `json:"importOnly,omitempty" tf:"import_only,omitempty"`
 
 	// Labels with user-defined metadata to apply to this resource.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The immutable purpose of this CryptoKey. See the
@@ -79,6 +80,7 @@ type CryptoKeyObservation struct {
 	KeyRing *string `json:"keyRing,omitempty" tf:"key_ring,omitempty"`
 
 	// Labels with user-defined metadata to apply to this resource.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The immutable purpose of this CryptoKey. See the
@@ -130,6 +132,7 @@ type CryptoKeyParameters struct {
 
 	// Labels with user-defined metadata to apply to this resource.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The immutable purpose of this CryptoKey. See the
diff --git a/apis/kms/v1beta1/zz_generated_terraformed.go b/apis/kms/v1beta1/zz_generated_terraformed.go
index 1fa11b73f..73bc15679 100755
--- a/apis/kms/v1beta1/zz_generated_terraformed.go
+++ b/apis/kms/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *CryptoKey) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this CryptoKey
+func (tr *CryptoKey) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this CryptoKey using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *CryptoKey) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *CryptoKeyIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this CryptoKeyIAMMember
+func (tr *CryptoKeyIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this CryptoKeyIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *CryptoKeyIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *CryptoKeyVersion) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this CryptoKeyVersion
+func (tr *CryptoKeyVersion) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this CryptoKeyVersion using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *CryptoKeyVersion) LateInitialize(attrs []byte) (bool, error) {
@@ -347,6 +438,36 @@ func (tr *KeyRing) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this KeyRing
+func (tr *KeyRing) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this KeyRing using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *KeyRing) LateInitialize(attrs []byte) (bool, error) {
@@ -431,6 +552,36 @@ func (tr *KeyRingIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this KeyRingIAMMember
+func (tr *KeyRingIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this KeyRingIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *KeyRingIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -515,6 +666,36 @@ func (tr *KeyRingImportJob) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this KeyRingImportJob
+func (tr *KeyRingImportJob) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this KeyRingImportJob using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *KeyRingImportJob) LateInitialize(attrs []byte) (bool, error) {
@@ -599,6 +780,36 @@ func (tr *SecretCiphertext) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this SecretCiphertext
+func (tr *SecretCiphertext) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this SecretCiphertext using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *SecretCiphertext) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/logging/v1beta1/zz_generated_terraformed.go b/apis/logging/v1beta1/zz_generated_terraformed.go
index 49747bbf8..356eead20 100755
--- a/apis/logging/v1beta1/zz_generated_terraformed.go
+++ b/apis/logging/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *FolderBucketConfig) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this FolderBucketConfig
+func (tr *FolderBucketConfig) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this FolderBucketConfig using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *FolderBucketConfig) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *FolderExclusion) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this FolderExclusion
+func (tr *FolderExclusion) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this FolderExclusion using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *FolderExclusion) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *FolderSink) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this FolderSink
+func (tr *FolderSink) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this FolderSink using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *FolderSink) LateInitialize(attrs []byte) (bool, error) {
@@ -347,6 +438,36 @@ func (tr *LogView) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this LogView
+func (tr *LogView) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this LogView using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *LogView) LateInitialize(attrs []byte) (bool, error) {
@@ -431,6 +552,36 @@ func (tr *Metric) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Metric
+func (tr *Metric) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Metric using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Metric) LateInitialize(attrs []byte) (bool, error) {
@@ -515,6 +666,36 @@ func (tr *ProjectBucketConfig) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ProjectBucketConfig
+func (tr *ProjectBucketConfig) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ProjectBucketConfig using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ProjectBucketConfig) LateInitialize(attrs []byte) (bool, error) {
@@ -599,6 +780,36 @@ func (tr *ProjectExclusion) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ProjectExclusion
+func (tr *ProjectExclusion) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ProjectExclusion using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ProjectExclusion) LateInitialize(attrs []byte) (bool, error) {
@@ -683,6 +894,36 @@ func (tr *ProjectSink) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ProjectSink
+func (tr *ProjectSink) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ProjectSink using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ProjectSink) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/logging/v1beta1/zz_metric_types.go b/apis/logging/v1beta1/zz_metric_types.go
index e6680045f..07bc9d5eb 100755
--- a/apis/logging/v1beta1/zz_metric_types.go
+++ b/apis/logging/v1beta1/zz_metric_types.go
@@ -351,6 +351,7 @@ type MetricInitParameters struct {
 	// entry field and assign as the label value. Each label key specified in the LabelDescriptor must
 	// have an associated extractor expression in this map. The syntax of the extractor expression is
 	// the same as for the valueExtractor field.
+	// +mapType=granular
 	LabelExtractors map[string]*string `json:"labelExtractors,omitempty" tf:"label_extractors,omitempty"`
 
 	// The optional metric descriptor associated with the logs-based metric.
@@ -403,6 +404,7 @@ type MetricObservation struct {
 	// entry field and assign as the label value. Each label key specified in the LabelDescriptor must
 	// have an associated extractor expression in this map. The syntax of the extractor expression is
 	// the same as for the valueExtractor field.
+	// +mapType=granular
 	LabelExtractors map[string]*string `json:"labelExtractors,omitempty" tf:"label_extractors,omitempty"`
 
 	// The optional metric descriptor associated with the logs-based metric.
@@ -468,6 +470,7 @@ type MetricParameters struct {
 	// have an associated extractor expression in this map. The syntax of the extractor expression is
 	// the same as for the valueExtractor field.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	LabelExtractors map[string]*string `json:"labelExtractors,omitempty" tf:"label_extractors,omitempty"`
 
 	// The optional metric descriptor associated with the logs-based metric.
diff --git a/apis/memcache/v1beta1/zz_generated_terraformed.go b/apis/memcache/v1beta1/zz_generated_terraformed.go
index cfde8f0b2..e774a3aef 100755
--- a/apis/memcache/v1beta1/zz_generated_terraformed.go
+++ b/apis/memcache/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Instance) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Instance
+func (tr *Instance) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Instance using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Instance) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/memcache/v1beta1/zz_instance_types.go b/apis/memcache/v1beta1/zz_instance_types.go
index 9762e5458..6d7064418 100755
--- a/apis/memcache/v1beta1/zz_instance_types.go
+++ b/apis/memcache/v1beta1/zz_instance_types.go
@@ -35,6 +35,7 @@ type InstanceInitParameters struct {
 	DisplayName *string `json:"displayName,omitempty" tf:"display_name,omitempty"`
 
 	// Resource labels to represent user-provided metadata.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Maintenance policy for an instance.
@@ -71,6 +72,7 @@ type InstanceInitParameters struct {
 
 	// Zones where memcache nodes should be provisioned.  If not
 	// provided, all zones will be used.
+	// +listType=set
 	Zones []*string `json:"zones,omitempty" tf:"zones,omitempty"`
 }
 
@@ -93,6 +95,7 @@ type InstanceObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// Resource labels to represent user-provided metadata.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Maintenance policy for an instance.
@@ -140,6 +143,7 @@ type InstanceObservation struct {
 
 	// Zones where memcache nodes should be provisioned.  If not
 	// provided, all zones will be used.
+	// +listType=set
 	Zones []*string `json:"zones,omitempty" tf:"zones,omitempty"`
 }
 
@@ -166,6 +170,7 @@ type InstanceParameters struct {
 
 	// Resource labels to represent user-provided metadata.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Maintenance policy for an instance.
@@ -211,6 +216,7 @@ type InstanceParameters struct {
 	// Zones where memcache nodes should be provisioned.  If not
 	// provided, all zones will be used.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Zones []*string `json:"zones,omitempty" tf:"zones,omitempty"`
 }
 
@@ -330,6 +336,7 @@ type MemcacheNodesParameters struct {
 type MemcacheParametersInitParameters struct {
 
 	// User-defined set of parameters to use in the memcache process.
+	// +mapType=granular
 	Params map[string]*string `json:"params,omitempty" tf:"params,omitempty"`
 }
 
@@ -340,6 +347,7 @@ type MemcacheParametersObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// User-defined set of parameters to use in the memcache process.
+	// +mapType=granular
 	Params map[string]*string `json:"params,omitempty" tf:"params,omitempty"`
 }
 
@@ -347,6 +355,7 @@ type MemcacheParametersParameters struct {
 
 	// User-defined set of parameters to use in the memcache process.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Params map[string]*string `json:"params,omitempty" tf:"params,omitempty"`
 }
 
diff --git a/apis/mlengine/v1beta1/zz_generated_terraformed.go b/apis/mlengine/v1beta1/zz_generated_terraformed.go
index d9afec5cc..7728c1954 100755
--- a/apis/mlengine/v1beta1/zz_generated_terraformed.go
+++ b/apis/mlengine/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Model) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Model
+func (tr *Model) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Model using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Model) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/mlengine/v1beta1/zz_model_types.go b/apis/mlengine/v1beta1/zz_model_types.go
index c01e67715..90d115ad1 100755
--- a/apis/mlengine/v1beta1/zz_model_types.go
+++ b/apis/mlengine/v1beta1/zz_model_types.go
@@ -59,6 +59,7 @@ type ModelInitParameters struct {
 	Description *string `json:"description,omitempty" tf:"description,omitempty"`
 
 	// One or more labels that you can add, to organize your models.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The name specified for the model.
@@ -93,6 +94,7 @@ type ModelObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// One or more labels that you can add, to organize your models.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The name specified for the model.
@@ -127,6 +129,7 @@ type ModelParameters struct {
 
 	// One or more labels that you can add, to organize your models.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The name specified for the model.
diff --git a/apis/monitoring/v1beta1/zz_alertpolicy_types.go b/apis/monitoring/v1beta1/zz_alertpolicy_types.go
index e973c73ce..ca2659cff 100755
--- a/apis/monitoring/v1beta1/zz_alertpolicy_types.go
+++ b/apis/monitoring/v1beta1/zz_alertpolicy_types.go
@@ -344,6 +344,7 @@ type AlertPolicyInitParameters struct {
 	// to 63 Unicode characters or 128 bytes, whichever is smaller. Labels and values
 	// can contain only lowercase letters, numerals, underscores, and dashes. Keys
 	// must begin with a letter.
+	// +mapType=granular
 	UserLabels map[string]*string `json:"userLabels,omitempty" tf:"user_labels,omitempty"`
 }
 
@@ -413,6 +414,7 @@ type AlertPolicyObservation struct {
 	// to 63 Unicode characters or 128 bytes, whichever is smaller. Labels and values
 	// can contain only lowercase letters, numerals, underscores, and dashes. Keys
 	// must begin with a letter.
+	// +mapType=granular
 	UserLabels map[string]*string `json:"userLabels,omitempty" tf:"user_labels,omitempty"`
 }
 
@@ -478,6 +480,7 @@ type AlertPolicyParameters struct {
 	// can contain only lowercase letters, numerals, underscores, and dashes. Keys
 	// must begin with a letter.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	UserLabels map[string]*string `json:"userLabels,omitempty" tf:"user_labels,omitempty"`
 }
 
@@ -742,6 +745,7 @@ type ConditionMatchedLogInitParameters struct {
 	// a separate rule for the purposes of triggering notifications.
 	// Label keys and corresponding values can be used in notifications
 	// generated by this condition.
+	// +mapType=granular
 	LabelExtractors map[string]*string `json:"labelExtractors,omitempty" tf:"label_extractors,omitempty"`
 }
 
@@ -768,6 +772,7 @@ type ConditionMatchedLogObservation struct {
 	// a separate rule for the purposes of triggering notifications.
 	// Label keys and corresponding values can be used in notifications
 	// generated by this condition.
+	// +mapType=granular
 	LabelExtractors map[string]*string `json:"labelExtractors,omitempty" tf:"label_extractors,omitempty"`
 }
 
@@ -796,6 +801,7 @@ type ConditionMatchedLogParameters struct {
 	// Label keys and corresponding values can be used in notifications
 	// generated by this condition.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	LabelExtractors map[string]*string `json:"labelExtractors,omitempty" tf:"label_extractors,omitempty"`
 }
 
@@ -1013,6 +1019,7 @@ type ConditionPrometheusQueryLanguageInitParameters struct {
 	// variable names are the names of the labels in the PromQL result, including
 	// "name" and "value". "labels" may be empty. This field is intended to be
 	// used for organizing and identifying the AlertPolicy
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The PromQL expression to evaluate. Every evaluation cycle this
@@ -1075,6 +1082,7 @@ type ConditionPrometheusQueryLanguageObservation struct {
 	// variable names are the names of the labels in the PromQL result, including
 	// "name" and "value". "labels" may be empty. This field is intended to be
 	// used for organizing and identifying the AlertPolicy
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The PromQL expression to evaluate. Every evaluation cycle this
@@ -1141,6 +1149,7 @@ type ConditionPrometheusQueryLanguageParameters struct {
 	// "name" and "value". "labels" may be empty. This field is intended to be
 	// used for organizing and identifying the AlertPolicy
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The PromQL expression to evaluate. Every evaluation cycle this
diff --git a/apis/monitoring/v1beta1/zz_customservice_types.go b/apis/monitoring/v1beta1/zz_customservice_types.go
index d5ddb16b2..f40cddd3a 100755
--- a/apis/monitoring/v1beta1/zz_customservice_types.go
+++ b/apis/monitoring/v1beta1/zz_customservice_types.go
@@ -52,6 +52,7 @@ type CustomServiceInitParameters struct {
 	// length of 63 characters, and must be less than 128 bytes in size. Up to 64
 	// label entries may be stored. For labels which do not have a semantic value,
 	// the empty string may be supplied for the label value.
+	// +mapType=granular
 	UserLabels map[string]*string `json:"userLabels,omitempty" tf:"user_labels,omitempty"`
 }
 
@@ -85,6 +86,7 @@ type CustomServiceObservation struct {
 	// length of 63 characters, and must be less than 128 bytes in size. Up to 64
 	// label entries may be stored. For labels which do not have a semantic value,
 	// the empty string may be supplied for the label value.
+	// +mapType=granular
 	UserLabels map[string]*string `json:"userLabels,omitempty" tf:"user_labels,omitempty"`
 }
 
@@ -116,6 +118,7 @@ type CustomServiceParameters struct {
 	// label entries may be stored. For labels which do not have a semantic value,
 	// the empty string may be supplied for the label value.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	UserLabels map[string]*string `json:"userLabels,omitempty" tf:"user_labels,omitempty"`
 }
 
diff --git a/apis/monitoring/v1beta1/zz_generated_terraformed.go b/apis/monitoring/v1beta1/zz_generated_terraformed.go
index e1902c44b..0e3a76970 100755
--- a/apis/monitoring/v1beta1/zz_generated_terraformed.go
+++ b/apis/monitoring/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *AlertPolicy) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this AlertPolicy
+func (tr *AlertPolicy) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this AlertPolicy using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *AlertPolicy) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *CustomService) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this CustomService
+func (tr *CustomService) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this CustomService using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *CustomService) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *Dashboard) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Dashboard
+func (tr *Dashboard) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Dashboard using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Dashboard) LateInitialize(attrs []byte) (bool, error) {
@@ -347,6 +438,36 @@ func (tr *Group) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Group
+func (tr *Group) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Group using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Group) LateInitialize(attrs []byte) (bool, error) {
@@ -431,6 +552,36 @@ func (tr *MetricDescriptor) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this MetricDescriptor
+func (tr *MetricDescriptor) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this MetricDescriptor using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *MetricDescriptor) LateInitialize(attrs []byte) (bool, error) {
@@ -515,6 +666,36 @@ func (tr *NotificationChannel) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this NotificationChannel
+func (tr *NotificationChannel) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this NotificationChannel using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *NotificationChannel) LateInitialize(attrs []byte) (bool, error) {
@@ -599,6 +780,36 @@ func (tr *Service) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Service
+func (tr *Service) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Service using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Service) LateInitialize(attrs []byte) (bool, error) {
@@ -683,6 +894,36 @@ func (tr *SLO) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this SLO
+func (tr *SLO) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this SLO using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *SLO) LateInitialize(attrs []byte) (bool, error) {
@@ -767,6 +1008,36 @@ func (tr *UptimeCheckConfig) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this UptimeCheckConfig
+func (tr *UptimeCheckConfig) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this UptimeCheckConfig using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *UptimeCheckConfig) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/monitoring/v1beta1/zz_metricdescriptor_types.go b/apis/monitoring/v1beta1/zz_metricdescriptor_types.go
index 66173a642..d2fa4f04a 100755
--- a/apis/monitoring/v1beta1/zz_metricdescriptor_types.go
+++ b/apis/monitoring/v1beta1/zz_metricdescriptor_types.go
@@ -186,6 +186,7 @@ type MetricDescriptorObservation struct {
 	MetricKind *string `json:"metricKind,omitempty" tf:"metric_kind,omitempty"`
 
 	// If present, then a time series, which is identified partially by a metric type and a MonitoredResourceDescriptor, that is associated with this metric type can only be associated with one of the monitored resource types listed here. This field allows time series to be associated with the intersection of this metric type and the monitored resource types in this list.
+	// +listType=set
 	MonitoredResourceTypes []*string `json:"monitoredResourceTypes,omitempty" tf:"monitored_resource_types,omitempty"`
 
 	// The resource name of the metric descriptor.
diff --git a/apis/monitoring/v1beta1/zz_notificationchannel_types.go b/apis/monitoring/v1beta1/zz_notificationchannel_types.go
index 5a6ccd887..1898bcbef 100755
--- a/apis/monitoring/v1beta1/zz_notificationchannel_types.go
+++ b/apis/monitoring/v1beta1/zz_notificationchannel_types.go
@@ -51,6 +51,7 @@ type NotificationChannelInitParameters struct {
 	// permissible and required labels are specified in the
 	// NotificationChannelDescriptor corresponding to the type field. They can also be configured via
 	// the sensitive_labels block, but cannot be configured in both places.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -70,6 +71,7 @@ type NotificationChannelInitParameters struct {
 	Type *string `json:"type,omitempty" tf:"type,omitempty"`
 
 	// User-supplied key/value data that does not need to conform to the corresponding NotificationChannelDescriptor's schema, unlike the labels field. This field is intended to be used for organizing and identifying the NotificationChannel objects.The field can contain up to 64 entries. Each key and value is limited to 63 Unicode characters or 128 bytes, whichever is smaller. Labels and values can contain only lowercase letters, numerals, underscores, and dashes. Keys must begin with a letter.
+	// +mapType=granular
 	UserLabels map[string]*string `json:"userLabels,omitempty" tf:"user_labels,omitempty"`
 }
 
@@ -98,6 +100,7 @@ type NotificationChannelObservation struct {
 	// permissible and required labels are specified in the
 	// NotificationChannelDescriptor corresponding to the type field. They can also be configured via
 	// the sensitive_labels block, but cannot be configured in both places.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The full REST resource name for this channel. The syntax is:
@@ -122,6 +125,7 @@ type NotificationChannelObservation struct {
 	Type *string `json:"type,omitempty" tf:"type,omitempty"`
 
 	// User-supplied key/value data that does not need to conform to the corresponding NotificationChannelDescriptor's schema, unlike the labels field. This field is intended to be used for organizing and identifying the NotificationChannel objects.The field can contain up to 64 entries. Each key and value is limited to 63 Unicode characters or 128 bytes, whichever is smaller. Labels and values can contain only lowercase letters, numerals, underscores, and dashes. Keys must begin with a letter.
+	// +mapType=granular
 	UserLabels map[string]*string `json:"userLabels,omitempty" tf:"user_labels,omitempty"`
 
 	// Indicates whether this channel has been verified or not. On a ListNotificationChannels or GetNotificationChannel operation, this field is expected to be populated.If the value is UNVERIFIED, then it indicates that the channel is non-functioning (it both requires verification and lacks verification); otherwise, it is assumed that the channel works.If the channel is neither VERIFIED nor UNVERIFIED, it implies that the channel is of a type that does not require verification or that this specific channel has been exempted from verification because it was created prior to verification being required for channels of this type.This field cannot be modified using a standard UpdateNotificationChannel operation. To change the value of this field, you must call VerifyNotificationChannel.
@@ -155,6 +159,7 @@ type NotificationChannelParameters struct {
 	// NotificationChannelDescriptor corresponding to the type field. They can also be configured via
 	// the sensitive_labels block, but cannot be configured in both places.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -178,6 +183,7 @@ type NotificationChannelParameters struct {
 
 	// User-supplied key/value data that does not need to conform to the corresponding NotificationChannelDescriptor's schema, unlike the labels field. This field is intended to be used for organizing and identifying the NotificationChannel objects.The field can contain up to 64 entries. Each key and value is limited to 63 Unicode characters or 128 bytes, whichever is smaller. Labels and values can contain only lowercase letters, numerals, underscores, and dashes. Keys must begin with a letter.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	UserLabels map[string]*string `json:"userLabels,omitempty" tf:"user_labels,omitempty"`
 }
 
diff --git a/apis/monitoring/v1beta1/zz_service_types.go b/apis/monitoring/v1beta1/zz_service_types.go
index b033ce99f..cb9ad56b4 100755
--- a/apis/monitoring/v1beta1/zz_service_types.go
+++ b/apis/monitoring/v1beta1/zz_service_types.go
@@ -33,6 +33,7 @@ type BasicServiceInitParameters struct {
 
 	// Labels that specify the resource that emits the monitoring data
 	// which is used for SLO reporting of this Service.
+	// +mapType=granular
 	ServiceLabels map[string]*string `json:"serviceLabels,omitempty" tf:"service_labels,omitempty"`
 
 	// The type of service that this basic service defines, e.g.
@@ -44,6 +45,7 @@ type BasicServiceObservation struct {
 
 	// Labels that specify the resource that emits the monitoring data
 	// which is used for SLO reporting of this Service.
+	// +mapType=granular
 	ServiceLabels map[string]*string `json:"serviceLabels,omitempty" tf:"service_labels,omitempty"`
 
 	// The type of service that this basic service defines, e.g.
@@ -56,6 +58,7 @@ type BasicServiceParameters struct {
 	// Labels that specify the resource that emits the monitoring data
 	// which is used for SLO reporting of this Service.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	ServiceLabels map[string]*string `json:"serviceLabels,omitempty" tf:"service_labels,omitempty"`
 
 	// The type of service that this basic service defines, e.g.
@@ -85,6 +88,7 @@ type ServiceInitParameters struct {
 	// length of 63 characters, and must be less than 128 bytes in size. Up to 64
 	// label entries may be stored. For labels which do not have a semantic value,
 	// the empty string may be supplied for the label value.
+	// +mapType=granular
 	UserLabels map[string]*string `json:"userLabels,omitempty" tf:"user_labels,omitempty"`
 }
 
@@ -120,6 +124,7 @@ type ServiceObservation struct {
 	// length of 63 characters, and must be less than 128 bytes in size. Up to 64
 	// label entries may be stored. For labels which do not have a semantic value,
 	// the empty string may be supplied for the label value.
+	// +mapType=granular
 	UserLabels map[string]*string `json:"userLabels,omitempty" tf:"user_labels,omitempty"`
 }
 
@@ -148,6 +153,7 @@ type ServiceParameters struct {
 	// label entries may be stored. For labels which do not have a semantic value,
 	// the empty string may be supplied for the label value.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	UserLabels map[string]*string `json:"userLabels,omitempty" tf:"user_labels,omitempty"`
 }
 
diff --git a/apis/monitoring/v1beta1/zz_slo_types.go b/apis/monitoring/v1beta1/zz_slo_types.go
index cbaf42023..c11552b5a 100755
--- a/apis/monitoring/v1beta1/zz_slo_types.go
+++ b/apis/monitoring/v1beta1/zz_slo_types.go
@@ -64,6 +64,7 @@ type BasicSliInitParameters struct {
 	// locations in which the Service has activity. For service types
 	// that don't support breaking down by location, setting this
 	// field will result in an error.
+	// +listType=set
 	Location []*string `json:"location,omitempty" tf:"location,omitempty"`
 
 	// An optional set of RPCs to which this SLI is relevant.
@@ -72,6 +73,7 @@ type BasicSliInitParameters struct {
 	// the Service's methods. For service types that don't support
 	// breaking down by method, setting this field will result in an
 	// error.
+	// +listType=set
 	Method []*string `json:"method,omitempty" tf:"method,omitempty"`
 
 	// The set of API versions to which this SLI is relevant.
@@ -80,6 +82,7 @@ type BasicSliInitParameters struct {
 	// this SLI applies to all API versions. For service types
 	// that don't support breaking down by version, setting this
 	// field will result in an error.
+	// +listType=set
 	Version []*string `json:"version,omitempty" tf:"version,omitempty"`
 }
 
@@ -99,6 +102,7 @@ type BasicSliObservation struct {
 	// locations in which the Service has activity. For service types
 	// that don't support breaking down by location, setting this
 	// field will result in an error.
+	// +listType=set
 	Location []*string `json:"location,omitempty" tf:"location,omitempty"`
 
 	// An optional set of RPCs to which this SLI is relevant.
@@ -107,6 +111,7 @@ type BasicSliObservation struct {
 	// the Service's methods. For service types that don't support
 	// breaking down by method, setting this field will result in an
 	// error.
+	// +listType=set
 	Method []*string `json:"method,omitempty" tf:"method,omitempty"`
 
 	// The set of API versions to which this SLI is relevant.
@@ -115,6 +120,7 @@ type BasicSliObservation struct {
 	// this SLI applies to all API versions. For service types
 	// that don't support breaking down by version, setting this
 	// field will result in an error.
+	// +listType=set
 	Version []*string `json:"version,omitempty" tf:"version,omitempty"`
 }
 
@@ -137,6 +143,7 @@ type BasicSliParameters struct {
 	// that don't support breaking down by location, setting this
 	// field will result in an error.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Location []*string `json:"location,omitempty" tf:"location,omitempty"`
 
 	// An optional set of RPCs to which this SLI is relevant.
@@ -146,6 +153,7 @@ type BasicSliParameters struct {
 	// breaking down by method, setting this field will result in an
 	// error.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Method []*string `json:"method,omitempty" tf:"method,omitempty"`
 
 	// The set of API versions to which this SLI is relevant.
@@ -155,6 +163,7 @@ type BasicSliParameters struct {
 	// that don't support breaking down by version, setting this
 	// field will result in an error.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Version []*string `json:"version,omitempty" tf:"version,omitempty"`
 }
 
@@ -193,6 +202,7 @@ type BasicSliPerformanceInitParameters struct {
 	// locations in which the Service has activity. For service types
 	// that don't support breaking down by location, setting this
 	// field will result in an error.
+	// +listType=set
 	Location []*string `json:"location,omitempty" tf:"location,omitempty"`
 
 	// An optional set of RPCs to which this SLI is relevant.
@@ -201,6 +211,7 @@ type BasicSliPerformanceInitParameters struct {
 	// the Service's methods. For service types that don't support
 	// breaking down by method, setting this field will result in an
 	// error.
+	// +listType=set
 	Method []*string `json:"method,omitempty" tf:"method,omitempty"`
 
 	// The set of API versions to which this SLI is relevant.
@@ -209,6 +220,7 @@ type BasicSliPerformanceInitParameters struct {
 	// this SLI applies to all API versions. For service types
 	// that don't support breaking down by version, setting this
 	// field will result in an error.
+	// +listType=set
 	Version []*string `json:"version,omitempty" tf:"version,omitempty"`
 }
 
@@ -253,6 +265,7 @@ type BasicSliPerformanceObservation struct {
 	// locations in which the Service has activity. For service types
 	// that don't support breaking down by location, setting this
 	// field will result in an error.
+	// +listType=set
 	Location []*string `json:"location,omitempty" tf:"location,omitempty"`
 
 	// An optional set of RPCs to which this SLI is relevant.
@@ -261,6 +274,7 @@ type BasicSliPerformanceObservation struct {
 	// the Service's methods. For service types that don't support
 	// breaking down by method, setting this field will result in an
 	// error.
+	// +listType=set
 	Method []*string `json:"method,omitempty" tf:"method,omitempty"`
 
 	// The set of API versions to which this SLI is relevant.
@@ -269,6 +283,7 @@ type BasicSliPerformanceObservation struct {
 	// this SLI applies to all API versions. For service types
 	// that don't support breaking down by version, setting this
 	// field will result in an error.
+	// +listType=set
 	Version []*string `json:"version,omitempty" tf:"version,omitempty"`
 }
 
@@ -291,6 +306,7 @@ type BasicSliPerformanceParameters struct {
 	// that don't support breaking down by location, setting this
 	// field will result in an error.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Location []*string `json:"location,omitempty" tf:"location,omitempty"`
 
 	// An optional set of RPCs to which this SLI is relevant.
@@ -300,6 +316,7 @@ type BasicSliPerformanceParameters struct {
 	// breaking down by method, setting this field will result in an
 	// error.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Method []*string `json:"method,omitempty" tf:"method,omitempty"`
 
 	// The set of API versions to which this SLI is relevant.
@@ -309,6 +326,7 @@ type BasicSliPerformanceParameters struct {
 	// that don't support breaking down by version, setting this
 	// field will result in an error.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	Version []*string `json:"version,omitempty" tf:"version,omitempty"`
 }
 
@@ -1129,6 +1147,7 @@ type SLOInitParameters struct {
 	// to 63 Unicode characters or 128 bytes, whichever is smaller. Labels and values
 	// can contain only lowercase letters, numerals, underscores, and dashes. Keys
 	// must begin with a letter.
+	// +mapType=granular
 	UserLabels map[string]*string `json:"userLabels,omitempty" tf:"user_labels,omitempty"`
 
 	// A windows-based SLI defines the criteria for time windows.
@@ -1202,6 +1221,7 @@ type SLOObservation struct {
 	// to 63 Unicode characters or 128 bytes, whichever is smaller. Labels and values
 	// can contain only lowercase letters, numerals, underscores, and dashes. Keys
 	// must begin with a letter.
+	// +mapType=granular
 	UserLabels map[string]*string `json:"userLabels,omitempty" tf:"user_labels,omitempty"`
 
 	// A windows-based SLI defines the criteria for time windows.
@@ -1288,6 +1308,7 @@ type SLOParameters struct {
 	// can contain only lowercase letters, numerals, underscores, and dashes. Keys
 	// must begin with a letter.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	UserLabels map[string]*string `json:"userLabels,omitempty" tf:"user_labels,omitempty"`
 
 	// A windows-based SLI defines the criteria for time windows.
diff --git a/apis/monitoring/v1beta1/zz_uptimecheckconfig_types.go b/apis/monitoring/v1beta1/zz_uptimecheckconfig_types.go
index 86a215fd5..bcb656e73 100755
--- a/apis/monitoring/v1beta1/zz_uptimecheckconfig_types.go
+++ b/apis/monitoring/v1beta1/zz_uptimecheckconfig_types.go
@@ -151,6 +151,7 @@ type HTTPCheckInitParameters struct {
 	ContentType *string `json:"contentType,omitempty" tf:"content_type,omitempty"`
 
 	// The list of headers to send as part of the uptime check request. If two headers have the same key and different values, they should be entered as a single header, with the value being a comma-separated list of all the desired values as described at https://www.w3.org/Protocols/rfc2616/rfc2616.txt (page 31). Entering two separate headers with the same key in a Create call will cause the first to be overwritten by the second. The maximum number of headers allowed is 100.
+	// +mapType=granular
 	Headers map[string]*string `json:"headers,omitempty" tf:"headers,omitempty"`
 
 	// Boolean specifying whether to encrypt the header information. Encryption should be specified for any headers related to authentication that you do not wish to be seen when retrieving the configuration. The server will be responsible for encrypting the headers. On Get/List calls, if mask_headers is set to True then the headers will be obscured with ******.
@@ -192,6 +193,7 @@ type HTTPCheckObservation struct {
 	ContentType *string `json:"contentType,omitempty" tf:"content_type,omitempty"`
 
 	// The list of headers to send as part of the uptime check request. If two headers have the same key and different values, they should be entered as a single header, with the value being a comma-separated list of all the desired values as described at https://www.w3.org/Protocols/rfc2616/rfc2616.txt (page 31). Entering two separate headers with the same key in a Create call will cause the first to be overwritten by the second. The maximum number of headers allowed is 100.
+	// +mapType=granular
 	Headers map[string]*string `json:"headers,omitempty" tf:"headers,omitempty"`
 
 	// Boolean specifying whether to encrypt the header information. Encryption should be specified for any headers related to authentication that you do not wish to be seen when retrieving the configuration. The server will be responsible for encrypting the headers. On Get/List calls, if mask_headers is set to True then the headers will be obscured with ******.
@@ -238,6 +240,7 @@ type HTTPCheckParameters struct {
 
 	// The list of headers to send as part of the uptime check request. If two headers have the same key and different values, they should be entered as a single header, with the value being a comma-separated list of all the desired values as described at https://www.w3.org/Protocols/rfc2616/rfc2616.txt (page 31). Entering two separate headers with the same key in a Create call will cause the first to be overwritten by the second. The maximum number of headers allowed is 100.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Headers map[string]*string `json:"headers,omitempty" tf:"headers,omitempty"`
 
 	// Boolean specifying whether to encrypt the header information. Encryption should be specified for any headers related to authentication that you do not wish to be seen when retrieving the configuration. The server will be responsible for encrypting the headers. On Get/List calls, if mask_headers is set to True then the headers will be obscured with ******.
@@ -305,6 +308,7 @@ type JSONPathMatcherParameters struct {
 type MonitoredResourceInitParameters struct {
 
 	// Values for all of the labels listed in the associated monitored resource descriptor. For example, Compute Engine VM instances use the labels "project_id", "instance_id", and "zone".
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The monitored resource type. This field must match the type field of a MonitoredResourceDescriptor (https://cloud.google.com/monitoring/api/ref_v3/rest/v3/projects.monitoredResourceDescriptors#MonitoredResourceDescriptor) object. For example, the type of a Compute Engine VM instance is gce_instance. For a list of types, see Monitoring resource types (https://cloud.google.com/monitoring/api/resources) and Logging resource types (https://cloud.google.com/logging/docs/api/v2/resource-list).
@@ -314,6 +318,7 @@ type MonitoredResourceInitParameters struct {
 type MonitoredResourceObservation struct {
 
 	// Values for all of the labels listed in the associated monitored resource descriptor. For example, Compute Engine VM instances use the labels "project_id", "instance_id", and "zone".
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The monitored resource type. This field must match the type field of a MonitoredResourceDescriptor (https://cloud.google.com/monitoring/api/ref_v3/rest/v3/projects.monitoredResourceDescriptors#MonitoredResourceDescriptor) object. For example, the type of a Compute Engine VM instance is gce_instance. For a list of types, see Monitoring resource types (https://cloud.google.com/monitoring/api/resources) and Logging resource types (https://cloud.google.com/logging/docs/api/v2/resource-list).
@@ -324,6 +329,7 @@ type MonitoredResourceParameters struct {
 
 	// Values for all of the labels listed in the associated monitored resource descriptor. For example, Compute Engine VM instances use the labels "project_id", "instance_id", and "zone".
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels" tf:"labels,omitempty"`
 
 	// The monitored resource type. This field must match the type field of a MonitoredResourceDescriptor (https://cloud.google.com/monitoring/api/ref_v3/rest/v3/projects.monitoredResourceDescriptors#MonitoredResourceDescriptor) object. For example, the type of a Compute Engine VM instance is gce_instance. For a list of types, see Monitoring resource types (https://cloud.google.com/monitoring/api/resources) and Logging resource types (https://cloud.google.com/logging/docs/api/v2/resource-list).
diff --git a/apis/networkconnectivity/v1beta1/zz_generated_terraformed.go b/apis/networkconnectivity/v1beta1/zz_generated_terraformed.go
index d76c1ae0f..46c273721 100755
--- a/apis/networkconnectivity/v1beta1/zz_generated_terraformed.go
+++ b/apis/networkconnectivity/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Hub) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Hub
+func (tr *Hub) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Hub using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Hub) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *Spoke) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Spoke
+func (tr *Spoke) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Spoke using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Spoke) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/networkconnectivity/v1beta1/zz_hub_types.go b/apis/networkconnectivity/v1beta1/zz_hub_types.go
index 440b755a4..2b2fcf39a 100755
--- a/apis/networkconnectivity/v1beta1/zz_hub_types.go
+++ b/apis/networkconnectivity/v1beta1/zz_hub_types.go
@@ -35,6 +35,7 @@ type HubInitParameters struct {
 	Description *string `json:"description,omitempty" tf:"description,omitempty"`
 
 	// Optional labels in key:value format. For more information about labels, see Requirements for labels.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Immutable. The name of the hub. Hub names must be unique. They use the following form: projects/{project_number}/locations/global/hubs/{hub_id}
@@ -56,6 +57,7 @@ type HubObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// Optional labels in key:value format. For more information about labels, see Requirements for labels.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Immutable. The name of the hub. Hub names must be unique. They use the following form: projects/{project_number}/locations/global/hubs/{hub_id}
@@ -85,6 +87,7 @@ type HubParameters struct {
 
 	// Optional labels in key:value format. For more information about labels, see Requirements for labels.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Immutable. The name of the hub. Hub names must be unique. They use the following form: projects/{project_number}/locations/global/hubs/{hub_id}
diff --git a/apis/networkconnectivity/v1beta1/zz_spoke_types.go b/apis/networkconnectivity/v1beta1/zz_spoke_types.go
index 5741f4a0d..1b5a34dbf 100755
--- a/apis/networkconnectivity/v1beta1/zz_spoke_types.go
+++ b/apis/networkconnectivity/v1beta1/zz_spoke_types.go
@@ -158,6 +158,7 @@ type SpokeInitParameters struct {
 	Description *string `json:"description,omitempty" tf:"description,omitempty"`
 
 	// Optional labels in key:value format. For more information about labels, see Requirements for labels.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// A collection of VLAN attachment resources. These resources should be redundant attachments that all advertise the same prefixes to Google Cloud. Alternatively, in active/passive configurations, all attachments should be capable of advertising the same prefixes.
@@ -194,6 +195,7 @@ type SpokeObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// Optional labels in key:value format. For more information about labels, see Requirements for labels.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// A collection of VLAN attachment resources. These resources should be redundant attachments that all advertise the same prefixes to Google Cloud. Alternatively, in active/passive configurations, all attachments should be capable of advertising the same prefixes.
@@ -246,6 +248,7 @@ type SpokeParameters struct {
 
 	// Optional labels in key:value format. For more information about labels, see Requirements for labels.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// A collection of VLAN attachment resources. These resources should be redundant attachments that all advertise the same prefixes to Google Cloud. Alternatively, in active/passive configurations, all attachments should be capable of advertising the same prefixes.
diff --git a/apis/networkmanagement/v1beta1/zz_connectivitytest_types.go b/apis/networkmanagement/v1beta1/zz_connectivitytest_types.go
index fab11f71e..bbffe4f2d 100755
--- a/apis/networkmanagement/v1beta1/zz_connectivitytest_types.go
+++ b/apis/networkmanagement/v1beta1/zz_connectivitytest_types.go
@@ -53,6 +53,7 @@ type ConnectivityTestInitParameters struct {
 	Destination []DestinationInitParameters `json:"destination,omitempty" tf:"destination,omitempty"`
 
 	// Resource labels to represent user-provided metadata.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Unique name for the connectivity test.
@@ -119,6 +120,7 @@ type ConnectivityTestObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// Resource labels to represent user-provided metadata.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Unique name for the connectivity test.
@@ -185,6 +187,7 @@ type ConnectivityTestParameters struct {
 
 	// Resource labels to represent user-provided metadata.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Unique name for the connectivity test.
diff --git a/apis/networkmanagement/v1beta1/zz_generated_terraformed.go b/apis/networkmanagement/v1beta1/zz_generated_terraformed.go
index 7750906d1..ac1775743 100755
--- a/apis/networkmanagement/v1beta1/zz_generated_terraformed.go
+++ b/apis/networkmanagement/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *ConnectivityTest) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ConnectivityTest
+func (tr *ConnectivityTest) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ConnectivityTest using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ConnectivityTest) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/notebooks/v1beta1/zz_generated_terraformed.go b/apis/notebooks/v1beta1/zz_generated_terraformed.go
index ab3b752f1..313284014 100755
--- a/apis/notebooks/v1beta1/zz_generated_terraformed.go
+++ b/apis/notebooks/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Environment) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Environment
+func (tr *Environment) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Environment using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Environment) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *Instance) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Instance
+func (tr *Instance) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Instance using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Instance) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *InstanceIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this InstanceIAMMember
+func (tr *InstanceIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this InstanceIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *InstanceIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -347,6 +438,36 @@ func (tr *Runtime) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Runtime
+func (tr *Runtime) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Runtime using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Runtime) LateInitialize(attrs []byte) (bool, error) {
@@ -431,6 +552,36 @@ func (tr *RuntimeIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this RuntimeIAMMember
+func (tr *RuntimeIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this RuntimeIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *RuntimeIAMMember) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/notebooks/v1beta1/zz_instance_types.go b/apis/notebooks/v1beta1/zz_instance_types.go
index 43991c80c..f26efb69c 100755
--- a/apis/notebooks/v1beta1/zz_instance_types.go
+++ b/apis/notebooks/v1beta1/zz_instance_types.go
@@ -150,6 +150,7 @@ type InstanceInitParameters struct {
 
 	// Labels to apply to this instance. These can be later modified by the setLabels method.
 	// An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// A reference to a machine type which defines VM kind.
@@ -157,6 +158,7 @@ type InstanceInitParameters struct {
 
 	// Custom metadata to apply to this instance.
 	// An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// The name of the VPC that this instance is in.
@@ -280,6 +282,7 @@ type InstanceObservation struct {
 
 	// Labels to apply to this instance. These can be later modified by the setLabels method.
 	// An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// A reference to the zone where the machine resides.
@@ -290,6 +293,7 @@ type InstanceObservation struct {
 
 	// Custom metadata to apply to this instance.
 	// An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// The name of the VPC that this instance is in.
@@ -429,6 +433,7 @@ type InstanceParameters struct {
 	// Labels to apply to this instance. These can be later modified by the setLabels method.
 	// An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// A reference to the zone where the machine resides.
@@ -442,6 +447,7 @@ type InstanceParameters struct {
 	// Custom metadata to apply to this instance.
 	// An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// The name of the VPC that this instance is in.
diff --git a/apis/notebooks/v1beta1/zz_runtime_types.go b/apis/notebooks/v1beta1/zz_runtime_types.go
index d856d864e..33438611e 100755
--- a/apis/notebooks/v1beta1/zz_runtime_types.go
+++ b/apis/notebooks/v1beta1/zz_runtime_types.go
@@ -306,6 +306,7 @@ type InitializeParamsInitParameters struct {
 	// empty, but, if present, must contain 1 to 63 characters, and must
 	// conform to RFC 1035. No
 	// more than 32 labels can be associated with a cluster.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 }
 
@@ -337,6 +338,7 @@ type InitializeParamsObservation struct {
 	// empty, but, if present, must contain 1 to 63 characters, and must
 	// conform to RFC 1035. No
 	// more than 32 labels can be associated with a cluster.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 }
 
@@ -373,6 +375,7 @@ type InitializeParamsParameters struct {
 	// conform to RFC 1035. No
 	// more than 32 labels can be associated with a cluster.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 }
 
@@ -416,6 +419,7 @@ type MetricsObservation struct {
 	// (Output)
 	// Contains runtime daemon metrics, such as OS and kernels and
 	// sessions stats.
+	// +mapType=granular
 	SystemMetrics map[string]*string `json:"systemMetrics,omitempty" tf:"system_metrics,omitempty"`
 }
 
@@ -696,6 +700,7 @@ type VirtualMachineConfigInitParameters struct {
 	// empty, but, if present, must contain 1 to 63 characters, and must
 	// conform to RFC 1035. No
 	// more than 32 labels can be associated with a cluster.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The Compute Engine machine type used for runtimes.
@@ -705,6 +710,7 @@ type VirtualMachineConfigInitParameters struct {
 	// (see [Project and instance metadata](https://cloud.google.com
 	// /compute/docs/storing-retrieving-metadata#project_and_instance
 	// _metadata)).
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// The Compute Engine network to be used for machine communications.
@@ -759,6 +765,7 @@ type VirtualMachineConfigObservation struct {
 	// The Compute Engine guest attributes. (see [Project and instance
 	// guest attributes](https://cloud.google.com/compute/docs/
 	// storing-retrieving-metadata#guest_attributes)).
+	// +mapType=granular
 	GuestAttributes map[string]*string `json:"guestAttributes,omitempty" tf:"guest_attributes,omitempty"`
 
 	// If true, runtime will only have internal IP addresses. By default,
@@ -775,6 +782,7 @@ type VirtualMachineConfigObservation struct {
 	// empty, but, if present, must contain 1 to 63 characters, and must
 	// conform to RFC 1035. No
 	// more than 32 labels can be associated with a cluster.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The Compute Engine machine type used for runtimes.
@@ -784,6 +792,7 @@ type VirtualMachineConfigObservation struct {
 	// (see [Project and instance metadata](https://cloud.google.com
 	// /compute/docs/storing-retrieving-metadata#project_and_instance
 	// _metadata)).
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// The Compute Engine network to be used for machine communications.
@@ -858,6 +867,7 @@ type VirtualMachineConfigParameters struct {
 	// conform to RFC 1035. No
 	// more than 32 labels can be associated with a cluster.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The Compute Engine machine type used for runtimes.
@@ -869,6 +879,7 @@ type VirtualMachineConfigParameters struct {
 	// /compute/docs/storing-retrieving-metadata#project_and_instance
 	// _metadata)).
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// The Compute Engine network to be used for machine communications.
diff --git a/apis/osconfig/v1beta1/zz_generated_terraformed.go b/apis/osconfig/v1beta1/zz_generated_terraformed.go
index c7216c115..911611001 100755
--- a/apis/osconfig/v1beta1/zz_generated_terraformed.go
+++ b/apis/osconfig/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *OsPolicyAssignment) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this OsPolicyAssignment
+func (tr *OsPolicyAssignment) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this OsPolicyAssignment using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *OsPolicyAssignment) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *PatchDeployment) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this PatchDeployment
+func (tr *PatchDeployment) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this PatchDeployment using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *PatchDeployment) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/osconfig/v1beta1/zz_ospolicyassignment_types.go b/apis/osconfig/v1beta1/zz_ospolicyassignment_types.go
index a68fd9e7b..8d93a3009 100755
--- a/apis/osconfig/v1beta1/zz_ospolicyassignment_types.go
+++ b/apis/osconfig/v1beta1/zz_ospolicyassignment_types.go
@@ -206,6 +206,7 @@ type ExclusionLabelsInitParameters struct {
 	// Labels are identified by key/value pairs in this map.
 	// A VM should contain all the key/value pairs specified in this map to be
 	// selected.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 }
 
@@ -214,6 +215,7 @@ type ExclusionLabelsObservation struct {
 	// Labels are identified by key/value pairs in this map.
 	// A VM should contain all the key/value pairs specified in this map to be
 	// selected.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 }
 
@@ -223,6 +225,7 @@ type ExclusionLabelsParameters struct {
 	// A VM should contain all the key/value pairs specified in this map to be
 	// selected.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 }
 
@@ -632,6 +635,7 @@ type InclusionLabelsInitParameters struct {
 	// Labels are identified by key/value pairs in this map.
 	// A VM should contain all the key/value pairs specified in this map to be
 	// selected.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 }
 
@@ -640,6 +644,7 @@ type InclusionLabelsObservation struct {
 	// Labels are identified by key/value pairs in this map.
 	// A VM should contain all the key/value pairs specified in this map to be
 	// selected.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 }
 
@@ -649,6 +654,7 @@ type InclusionLabelsParameters struct {
 	// A VM should contain all the key/value pairs specified in this map to be
 	// selected.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 }
 
diff --git a/apis/osconfig/v1beta1/zz_patchdeployment_types.go b/apis/osconfig/v1beta1/zz_patchdeployment_types.go
index 33686944e..239099f26 100755
--- a/apis/osconfig/v1beta1/zz_patchdeployment_types.go
+++ b/apis/osconfig/v1beta1/zz_patchdeployment_types.go
@@ -71,12 +71,14 @@ type GcsObjectParameters struct {
 type GroupLabelsInitParameters struct {
 
 	// Compute Engine instance labels that must be present for a VM instance to be targeted by this filter
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 }
 
 type GroupLabelsObservation struct {
 
 	// Compute Engine instance labels that must be present for a VM instance to be targeted by this filter
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 }
 
@@ -84,6 +86,7 @@ type GroupLabelsParameters struct {
 
 	// Compute Engine instance labels that must be present for a VM instance to be targeted by this filter
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels" tf:"labels,omitempty"`
 }
 
diff --git a/apis/oslogin/v1beta1/zz_generated_terraformed.go b/apis/oslogin/v1beta1/zz_generated_terraformed.go
index c0017fca9..fb2d1053e 100755
--- a/apis/oslogin/v1beta1/zz_generated_terraformed.go
+++ b/apis/oslogin/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *SSHPublicKey) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this SSHPublicKey
+func (tr *SSHPublicKey) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this SSHPublicKey using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *SSHPublicKey) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/privateca/v1beta1/zz_capool_types.go b/apis/privateca/v1beta1/zz_capool_types.go
index ba2eaa9ac..565d4d04f 100755
--- a/apis/privateca/v1beta1/zz_capool_types.go
+++ b/apis/privateca/v1beta1/zz_capool_types.go
@@ -391,6 +391,7 @@ type CAPoolInitParameters struct {
 	// Labels with user-defined metadata.
 	// An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass":
 	// "1.3kg", "count": "3" }.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -418,6 +419,7 @@ type CAPoolObservation struct {
 	// Labels with user-defined metadata.
 	// An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass":
 	// "1.3kg", "count": "3" }.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Location of the CaPool. A full list of valid locations can be found by
@@ -448,6 +450,7 @@ type CAPoolParameters struct {
 	// An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass":
 	// "1.3kg", "count": "3" }.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Location of the CaPool. A full list of valid locations can be found by
diff --git a/apis/privateca/v1beta1/zz_certificate_types.go b/apis/privateca/v1beta1/zz_certificate_types.go
index 288ff2e44..1cc6cdaff 100755
--- a/apis/privateca/v1beta1/zz_certificate_types.go
+++ b/apis/privateca/v1beta1/zz_certificate_types.go
@@ -126,6 +126,7 @@ type CertificateInitParameters struct {
 	Config []ConfigInitParameters `json:"config,omitempty" tf:"config,omitempty"`
 
 	// Labels with user-defined metadata to apply to this resource.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The desired lifetime of the CA certificate. Used to create the "notBeforeTime" and
@@ -175,6 +176,7 @@ type CertificateObservation struct {
 	IssuerCertificateAuthority *string `json:"issuerCertificateAuthority,omitempty" tf:"issuer_certificate_authority,omitempty"`
 
 	// Labels with user-defined metadata to apply to this resource.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The desired lifetime of the CA certificate. Used to create the "notBeforeTime" and
@@ -259,6 +261,7 @@ type CertificateParameters struct {
 
 	// Labels with user-defined metadata to apply to this resource.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The desired lifetime of the CA certificate. Used to create the "notBeforeTime" and
diff --git a/apis/privateca/v1beta1/zz_certificateauthority_types.go b/apis/privateca/v1beta1/zz_certificateauthority_types.go
index 6f4569534..d52f7e966 100755
--- a/apis/privateca/v1beta1/zz_certificateauthority_types.go
+++ b/apis/privateca/v1beta1/zz_certificateauthority_types.go
@@ -114,6 +114,7 @@ type CertificateAuthorityInitParameters struct {
 	// Labels with user-defined metadata.
 	// An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass":
 	// "1.3kg", "count": "3" }.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The desired lifetime of the CA certificate. Used to create the "notBeforeTime" and
@@ -190,6 +191,7 @@ type CertificateAuthorityObservation struct {
 	// Labels with user-defined metadata.
 	// An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass":
 	// "1.3kg", "count": "3" }.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The desired lifetime of the CA certificate. Used to create the "notBeforeTime" and
@@ -286,6 +288,7 @@ type CertificateAuthorityParameters struct {
 	// An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass":
 	// "1.3kg", "count": "3" }.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The desired lifetime of the CA certificate. Used to create the "notBeforeTime" and
diff --git a/apis/privateca/v1beta1/zz_certificatetemplate_types.go b/apis/privateca/v1beta1/zz_certificatetemplate_types.go
index 93713e98c..021f12839 100755
--- a/apis/privateca/v1beta1/zz_certificatetemplate_types.go
+++ b/apis/privateca/v1beta1/zz_certificatetemplate_types.go
@@ -77,6 +77,7 @@ type CertificateTemplateInitParameters struct {
 	IdentityConstraints []CertificateTemplateIdentityConstraintsInitParameters `json:"identityConstraints,omitempty" tf:"identity_constraints,omitempty"`
 
 	// Optional. Labels with user-defined metadata.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Optional. Describes the set of X.509 extensions that may appear in a Certificate issued using this CertificateTemplate. If a certificate request sets extensions that don't appear in the passthrough_extensions, those extensions will be dropped. If the issuing CaPool's IssuancePolicy defines baseline_values that don't appear here, the certificate issuance request will fail. If this is omitted, then this template will not add restrictions on a certificate's X.509 extensions. These constraints do not apply to X.509 extensions set in this CertificateTemplate's predefined_values.
@@ -104,6 +105,7 @@ type CertificateTemplateObservation struct {
 	IdentityConstraints []CertificateTemplateIdentityConstraintsObservation `json:"identityConstraints,omitempty" tf:"identity_constraints,omitempty"`
 
 	// Optional. Labels with user-defined metadata.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The location for the resource
@@ -134,6 +136,7 @@ type CertificateTemplateParameters struct {
 
 	// Optional. Labels with user-defined metadata.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The location for the resource
diff --git a/apis/privateca/v1beta1/zz_generated_terraformed.go b/apis/privateca/v1beta1/zz_generated_terraformed.go
index 187a9a960..616cdd8fb 100755
--- a/apis/privateca/v1beta1/zz_generated_terraformed.go
+++ b/apis/privateca/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *CAPool) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this CAPool
+func (tr *CAPool) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this CAPool using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *CAPool) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *CAPoolIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this CAPoolIAMMember
+func (tr *CAPoolIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this CAPoolIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *CAPoolIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *Certificate) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Certificate
+func (tr *Certificate) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Certificate using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Certificate) LateInitialize(attrs []byte) (bool, error) {
@@ -347,6 +438,36 @@ func (tr *CertificateAuthority) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this CertificateAuthority
+func (tr *CertificateAuthority) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this CertificateAuthority using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *CertificateAuthority) LateInitialize(attrs []byte) (bool, error) {
@@ -431,6 +552,36 @@ func (tr *CertificateTemplate) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this CertificateTemplate
+func (tr *CertificateTemplate) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this CertificateTemplate using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *CertificateTemplate) LateInitialize(attrs []byte) (bool, error) {
@@ -515,6 +666,36 @@ func (tr *CertificateTemplateIAMMember) GetInitParameters() (map[string]any, err
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this CertificateTemplateIAMMember
+func (tr *CertificateTemplateIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this CertificateTemplateIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *CertificateTemplateIAMMember) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/pubsub/v1beta1/zz_generated_terraformed.go b/apis/pubsub/v1beta1/zz_generated_terraformed.go
index 02135fb6e..bbd28a43c 100755
--- a/apis/pubsub/v1beta1/zz_generated_terraformed.go
+++ b/apis/pubsub/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *LiteReservation) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this LiteReservation
+func (tr *LiteReservation) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this LiteReservation using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *LiteReservation) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *LiteSubscription) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this LiteSubscription
+func (tr *LiteSubscription) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this LiteSubscription using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *LiteSubscription) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *LiteTopic) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this LiteTopic
+func (tr *LiteTopic) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this LiteTopic using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *LiteTopic) LateInitialize(attrs []byte) (bool, error) {
@@ -347,6 +438,36 @@ func (tr *Schema) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Schema
+func (tr *Schema) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Schema using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Schema) LateInitialize(attrs []byte) (bool, error) {
@@ -431,6 +552,36 @@ func (tr *Subscription) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Subscription
+func (tr *Subscription) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Subscription using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Subscription) LateInitialize(attrs []byte) (bool, error) {
@@ -515,6 +666,36 @@ func (tr *SubscriptionIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this SubscriptionIAMMember
+func (tr *SubscriptionIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this SubscriptionIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *SubscriptionIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -599,6 +780,36 @@ func (tr *Topic) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Topic
+func (tr *Topic) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Topic using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Topic) LateInitialize(attrs []byte) (bool, error) {
@@ -683,6 +894,36 @@ func (tr *TopicIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this TopicIAMMember
+func (tr *TopicIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this TopicIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *TopicIAMMember) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/pubsub/v1beta1/zz_subscription_types.go b/apis/pubsub/v1beta1/zz_subscription_types.go
index da511d9af..0667b8e08 100755
--- a/apis/pubsub/v1beta1/zz_subscription_types.go
+++ b/apis/pubsub/v1beta1/zz_subscription_types.go
@@ -284,6 +284,7 @@ type PushConfigInitParameters struct {
 	// calls will always return a valid version, even if the
 	// subscription was created without this attribute.
 	// The possible values for this attribute are:
+	// +mapType=granular
 	Attributes map[string]*string `json:"attributes,omitempty" tf:"attributes,omitempty"`
 
 	// When set, the payload to the push endpoint is not wrapped.Sets the
@@ -320,6 +321,7 @@ type PushConfigObservation struct {
 	// calls will always return a valid version, even if the
 	// subscription was created without this attribute.
 	// The possible values for this attribute are:
+	// +mapType=granular
 	Attributes map[string]*string `json:"attributes,omitempty" tf:"attributes,omitempty"`
 
 	// When set, the payload to the push endpoint is not wrapped.Sets the
@@ -357,6 +359,7 @@ type PushConfigParameters struct {
 	// subscription was created without this attribute.
 	// The possible values for this attribute are:
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Attributes map[string]*string `json:"attributes,omitempty" tf:"attributes,omitempty"`
 
 	// When set, the payload to the push endpoint is not wrapped.Sets the
@@ -474,6 +477,7 @@ type SubscriptionInitParameters struct {
 	Filter *string `json:"filter,omitempty" tf:"filter,omitempty"`
 
 	// A set of key/value label pairs to assign to this Subscription.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// How long to retain unacknowledged messages in the subscription's
@@ -573,6 +577,7 @@ type SubscriptionObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// A set of key/value label pairs to assign to this Subscription.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// How long to retain unacknowledged messages in the subscription's
@@ -680,6 +685,7 @@ type SubscriptionParameters struct {
 
 	// A set of key/value label pairs to assign to this Subscription.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// How long to retain unacknowledged messages in the subscription's
diff --git a/apis/pubsub/v1beta1/zz_topic_types.go b/apis/pubsub/v1beta1/zz_topic_types.go
index 2c6ac475a..0e4745f87 100755
--- a/apis/pubsub/v1beta1/zz_topic_types.go
+++ b/apis/pubsub/v1beta1/zz_topic_types.go
@@ -110,6 +110,7 @@ type SchemaSettingsParameters struct {
 type TopicInitParameters struct {
 
 	// A set of key/value label pairs to assign to this Topic.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Indicates the minimum duration to retain a message after it is published
@@ -149,6 +150,7 @@ type TopicObservation struct {
 	KMSKeyName *string `json:"kmsKeyName,omitempty" tf:"kms_key_name,omitempty"`
 
 	// A set of key/value label pairs to assign to this Topic.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Indicates the minimum duration to retain a message after it is published
@@ -197,6 +199,7 @@ type TopicParameters struct {
 
 	// A set of key/value label pairs to assign to this Topic.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Indicates the minimum duration to retain a message after it is published
diff --git a/apis/redis/v1beta1/zz_generated_terraformed.go b/apis/redis/v1beta1/zz_generated_terraformed.go
index 564dd9d7e..b26dc3d44 100755
--- a/apis/redis/v1beta1/zz_generated_terraformed.go
+++ b/apis/redis/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Instance) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Instance
+func (tr *Instance) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Instance using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Instance) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/redis/v1beta1/zz_instance_types.go b/apis/redis/v1beta1/zz_instance_types.go
index 433a76834..efbea91a2 100755
--- a/apis/redis/v1beta1/zz_instance_types.go
+++ b/apis/redis/v1beta1/zz_instance_types.go
@@ -56,6 +56,7 @@ type InstanceInitParameters struct {
 	DisplayName *string `json:"displayName,omitempty" tf:"display_name,omitempty"`
 
 	// Resource labels to represent user provided metadata.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The zone where the instance will be provisioned. If not provided,
@@ -87,6 +88,7 @@ type InstanceInitParameters struct {
 	// Redis configuration parameters, according to http://redis.io/topics/config.
 	// Please check Memorystore documentation for the list of supported parameters:
 	// https://cloud.google.com/memorystore/docs/redis/reference/rest/v1/projects.locations.instances#Instance.FIELDS.redis_configs
+	// +mapType=granular
 	RedisConfigs map[string]*string `json:"redisConfigs,omitempty" tf:"redis_configs,omitempty"`
 
 	// The version of Redis software. If not provided, latest supported
@@ -169,6 +171,7 @@ type InstanceObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// Resource labels to represent user provided metadata.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The zone where the instance will be provisioned. If not provided,
@@ -226,6 +229,7 @@ type InstanceObservation struct {
 	// Redis configuration parameters, according to http://redis.io/topics/config.
 	// Please check Memorystore documentation for the list of supported parameters:
 	// https://cloud.google.com/memorystore/docs/redis/reference/rest/v1/projects.locations.instances#Instance.FIELDS.redis_configs
+	// +mapType=granular
 	RedisConfigs map[string]*string `json:"redisConfigs,omitempty" tf:"redis_configs,omitempty"`
 
 	// The version of Redis software. If not provided, latest supported
@@ -314,6 +318,7 @@ type InstanceParameters struct {
 
 	// Resource labels to represent user provided metadata.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The zone where the instance will be provisioned. If not provided,
@@ -352,6 +357,7 @@ type InstanceParameters struct {
 	// Please check Memorystore documentation for the list of supported parameters:
 	// https://cloud.google.com/memorystore/docs/redis/reference/rest/v1/projects.locations.instances#Instance.FIELDS.redis_configs
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	RedisConfigs map[string]*string `json:"redisConfigs,omitempty" tf:"redis_configs,omitempty"`
 
 	// The version of Redis software. If not provided, latest supported
diff --git a/apis/secretmanager/v1beta1/zz_generated_terraformed.go b/apis/secretmanager/v1beta1/zz_generated_terraformed.go
index e14c83dc8..f5eabfe22 100755
--- a/apis/secretmanager/v1beta1/zz_generated_terraformed.go
+++ b/apis/secretmanager/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Secret) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Secret
+func (tr *Secret) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Secret using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Secret) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *SecretIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this SecretIAMMember
+func (tr *SecretIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this SecretIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *SecretIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *SecretVersion) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this SecretVersion
+func (tr *SecretVersion) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this SecretVersion using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *SecretVersion) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/secretmanager/v1beta1/zz_secret_types.go b/apis/secretmanager/v1beta1/zz_secret_types.go
index c34975427..06dc60c8d 100755
--- a/apis/secretmanager/v1beta1/zz_secret_types.go
+++ b/apis/secretmanager/v1beta1/zz_secret_types.go
@@ -161,6 +161,7 @@ type SecretInitParameters struct {
 	// No more than 64 labels can be assigned to a given resource.
 	// An object containing a list of "key": value pairs. Example:
 	// { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -205,6 +206,7 @@ type SecretObservation struct {
 	// No more than 64 labels can be assigned to a given resource.
 	// An object containing a list of "key": value pairs. Example:
 	// { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The resource name of the Secret. Format:
@@ -249,6 +251,7 @@ type SecretParameters struct {
 	// An object containing a list of "key": value pairs. Example:
 	// { "name": "wrench", "mass": "1.3kg", "count": "3" }.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
diff --git a/apis/servicenetworking/v1beta1/zz_generated_terraformed.go b/apis/servicenetworking/v1beta1/zz_generated_terraformed.go
index 47c5058c5..c0b9f1074 100755
--- a/apis/servicenetworking/v1beta1/zz_generated_terraformed.go
+++ b/apis/servicenetworking/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Connection) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Connection
+func (tr *Connection) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Connection using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Connection) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/sourcerepo/v1beta1/zz_generated_terraformed.go b/apis/sourcerepo/v1beta1/zz_generated_terraformed.go
index 910f6fc03..ac1e7e066 100755
--- a/apis/sourcerepo/v1beta1/zz_generated_terraformed.go
+++ b/apis/sourcerepo/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Repository) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Repository
+func (tr *Repository) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Repository using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Repository) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *RepositoryIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this RepositoryIAMMember
+func (tr *RepositoryIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this RepositoryIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *RepositoryIAMMember) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/spanner/v1beta1/zz_generated_terraformed.go b/apis/spanner/v1beta1/zz_generated_terraformed.go
index 476504d5f..7f26a030c 100755
--- a/apis/spanner/v1beta1/zz_generated_terraformed.go
+++ b/apis/spanner/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Database) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Database
+func (tr *Database) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Database using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Database) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *DatabaseIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this DatabaseIAMMember
+func (tr *DatabaseIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this DatabaseIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *DatabaseIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *Instance) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Instance
+func (tr *Instance) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Instance using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Instance) LateInitialize(attrs []byte) (bool, error) {
@@ -349,6 +440,36 @@ func (tr *InstanceIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this InstanceIAMMember
+func (tr *InstanceIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this InstanceIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *InstanceIAMMember) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/spanner/v1beta1/zz_instance_types.go b/apis/spanner/v1beta1/zz_instance_types.go
index 8e810767f..c64c45dc2 100755
--- a/apis/spanner/v1beta1/zz_instance_types.go
+++ b/apis/spanner/v1beta1/zz_instance_types.go
@@ -49,6 +49,7 @@ type InstanceInitParameters struct {
 
 	// An object containing a list of "key": value pairs.
 	// Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The number of nodes allocated to this instance.
@@ -85,6 +86,7 @@ type InstanceObservation struct {
 
 	// An object containing a list of "key": value pairs.
 	// Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The number of nodes allocated to this instance.
@@ -125,6 +127,7 @@ type InstanceParameters struct {
 	// An object containing a list of "key": value pairs.
 	// Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The number of nodes allocated to this instance.
diff --git a/apis/sql/v1beta1/zz_databaseinstance_types.go b/apis/sql/v1beta1/zz_databaseinstance_types.go
index eaf031fb9..6b8fad042 100755
--- a/apis/sql/v1beta1/zz_databaseinstance_types.go
+++ b/apis/sql/v1beta1/zz_databaseinstance_types.go
@@ -1246,6 +1246,7 @@ type SettingsInitParameters struct {
 	TimeZone *string `json:"timeZone,omitempty" tf:"time_zone,omitempty"`
 
 	// A set of key/value user label pairs to assign to the instance.
+	// +mapType=granular
 	UserLabels map[string]*string `json:"userLabels,omitempty" tf:"user_labels,omitempty"`
 }
 
@@ -1323,6 +1324,7 @@ type SettingsObservation struct {
 	TimeZone *string `json:"timeZone,omitempty" tf:"time_zone,omitempty"`
 
 	// A set of key/value user label pairs to assign to the instance.
+	// +mapType=granular
 	UserLabels map[string]*string `json:"userLabels,omitempty" tf:"user_labels,omitempty"`
 
 	// Used to make sure changes to the settings block are
@@ -1430,6 +1432,7 @@ type SettingsParameters struct {
 
 	// A set of key/value user label pairs to assign to the instance.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	UserLabels map[string]*string `json:"userLabels,omitempty" tf:"user_labels,omitempty"`
 }
 
diff --git a/apis/sql/v1beta1/zz_generated_terraformed.go b/apis/sql/v1beta1/zz_generated_terraformed.go
index f33820e25..20bc431dd 100755
--- a/apis/sql/v1beta1/zz_generated_terraformed.go
+++ b/apis/sql/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Database) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Database
+func (tr *Database) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Database using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Database) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *DatabaseInstance) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this DatabaseInstance
+func (tr *DatabaseInstance) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this DatabaseInstance using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *DatabaseInstance) LateInitialize(attrs []byte) (bool, error) {
@@ -264,6 +325,36 @@ func (tr *SourceRepresentationInstance) GetInitParameters() (map[string]any, err
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this SourceRepresentationInstance
+func (tr *SourceRepresentationInstance) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this SourceRepresentationInstance using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *SourceRepresentationInstance) LateInitialize(attrs []byte) (bool, error) {
@@ -348,6 +439,36 @@ func (tr *SSLCert) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this SSLCert
+func (tr *SSLCert) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this SSLCert using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *SSLCert) LateInitialize(attrs []byte) (bool, error) {
@@ -432,6 +553,36 @@ func (tr *User) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this User
+func (tr *User) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this User using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *User) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/storage/v1beta1/zz_bucket_types.go b/apis/storage/v1beta1/zz_bucket_types.go
index 5f793f05d..71de97e41 100755
--- a/apis/storage/v1beta1/zz_bucket_types.go
+++ b/apis/storage/v1beta1/zz_bucket_types.go
@@ -99,6 +99,7 @@ type BucketInitParameters struct {
 	ForceDestroy *bool `json:"forceDestroy,omitempty" tf:"force_destroy,omitempty"`
 
 	// A map of key/value label pairs to assign to the bucket.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The bucket's Lifecycle Rules configuration. Multiple blocks of this type are permitted. Structure is documented below.
@@ -160,6 +161,7 @@ type BucketObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// A map of key/value label pairs to assign to the bucket.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The bucket's Lifecycle Rules configuration. Multiple blocks of this type are permitted. Structure is documented below.
@@ -232,6 +234,7 @@ type BucketParameters struct {
 
 	// A map of key/value label pairs to assign to the bucket.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The bucket's Lifecycle Rules configuration. Multiple blocks of this type are permitted. Structure is documented below.
@@ -451,12 +454,14 @@ type CorsParameters struct {
 type CustomPlacementConfigInitParameters struct {
 
 	// The list of individual regions that comprise a dual-region bucket. See Cloud Storage bucket locations for a list of acceptable regions. Note: If any of the data_locations changes, it will recreate the bucket.
+	// +listType=set
 	DataLocations []*string `json:"dataLocations,omitempty" tf:"data_locations,omitempty"`
 }
 
 type CustomPlacementConfigObservation struct {
 
 	// The list of individual regions that comprise a dual-region bucket. See Cloud Storage bucket locations for a list of acceptable regions. Note: If any of the data_locations changes, it will recreate the bucket.
+	// +listType=set
 	DataLocations []*string `json:"dataLocations,omitempty" tf:"data_locations,omitempty"`
 }
 
@@ -464,6 +469,7 @@ type CustomPlacementConfigParameters struct {
 
 	// The list of individual regions that comprise a dual-region bucket. See Cloud Storage bucket locations for a list of acceptable regions. Note: If any of the data_locations changes, it will recreate the bucket.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	DataLocations []*string `json:"dataLocations" tf:"data_locations,omitempty"`
 }
 
diff --git a/apis/storage/v1beta1/zz_bucketobject_types.go b/apis/storage/v1beta1/zz_bucketobject_types.go
index ea09eb339..51d1874a1 100755
--- a/apis/storage/v1beta1/zz_bucketobject_types.go
+++ b/apis/storage/v1beta1/zz_bucketobject_types.go
@@ -64,6 +64,7 @@ type BucketObjectInitParameters struct {
 	KMSKeyName *string `json:"kmsKeyName,omitempty" tf:"kms_key_name,omitempty"`
 
 	// User-provided metadata, in key/value pairs.
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// The name of the object. If you're interpolating the name of this object, see output_name instead.
@@ -131,6 +132,7 @@ type BucketObjectObservation struct {
 	MediaLink *string `json:"mediaLink,omitempty" tf:"media_link,omitempty"`
 
 	// User-provided metadata, in key/value pairs.
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// The name of the object. If you're interpolating the name of this object, see output_name instead.
@@ -215,6 +217,7 @@ type BucketObjectParameters struct {
 
 	// User-provided metadata, in key/value pairs.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Metadata map[string]*string `json:"metadata,omitempty" tf:"metadata,omitempty"`
 
 	// The name of the object. If you're interpolating the name of this object, see output_name instead.
diff --git a/apis/storage/v1beta1/zz_defaultobjectacl_types.go b/apis/storage/v1beta1/zz_defaultobjectacl_types.go
index ad910b600..7f894e0f5 100755
--- a/apis/storage/v1beta1/zz_defaultobjectacl_types.go
+++ b/apis/storage/v1beta1/zz_defaultobjectacl_types.go
@@ -34,6 +34,7 @@ type DefaultObjectACLInitParameters struct {
 	// List of role/entity pairs in the form ROLE:entity.
 	// See GCS Object ACL documentation for more details.
 	// Omitting the field is the same as providing an empty list.
+	// +listType=set
 	RoleEntity []*string `json:"roleEntity,omitempty" tf:"role_entity,omitempty"`
 }
 
@@ -47,6 +48,7 @@ type DefaultObjectACLObservation struct {
 	// List of role/entity pairs in the form ROLE:entity.
 	// See GCS Object ACL documentation for more details.
 	// Omitting the field is the same as providing an empty list.
+	// +listType=set
 	RoleEntity []*string `json:"roleEntity,omitempty" tf:"role_entity,omitempty"`
 }
 
@@ -69,6 +71,7 @@ type DefaultObjectACLParameters struct {
 	// See GCS Object ACL documentation for more details.
 	// Omitting the field is the same as providing an empty list.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	RoleEntity []*string `json:"roleEntity,omitempty" tf:"role_entity,omitempty"`
 }
 
diff --git a/apis/storage/v1beta1/zz_generated_terraformed.go b/apis/storage/v1beta1/zz_generated_terraformed.go
index 745ffa694..3cc763788 100755
--- a/apis/storage/v1beta1/zz_generated_terraformed.go
+++ b/apis/storage/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Bucket) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Bucket
+func (tr *Bucket) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Bucket using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Bucket) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *BucketAccessControl) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this BucketAccessControl
+func (tr *BucketAccessControl) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this BucketAccessControl using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *BucketAccessControl) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *BucketACL) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this BucketACL
+func (tr *BucketACL) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this BucketACL using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *BucketACL) LateInitialize(attrs []byte) (bool, error) {
@@ -347,6 +438,36 @@ func (tr *BucketIAMMember) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this BucketIAMMember
+func (tr *BucketIAMMember) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this BucketIAMMember using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *BucketIAMMember) LateInitialize(attrs []byte) (bool, error) {
@@ -431,6 +552,36 @@ func (tr *BucketObject) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this BucketObject
+func (tr *BucketObject) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this BucketObject using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *BucketObject) LateInitialize(attrs []byte) (bool, error) {
@@ -515,6 +666,36 @@ func (tr *DefaultObjectAccessControl) GetInitParameters() (map[string]any, error
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this DefaultObjectAccessControl
+func (tr *DefaultObjectAccessControl) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this DefaultObjectAccessControl using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *DefaultObjectAccessControl) LateInitialize(attrs []byte) (bool, error) {
@@ -599,6 +780,36 @@ func (tr *DefaultObjectACL) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this DefaultObjectACL
+func (tr *DefaultObjectACL) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this DefaultObjectACL using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *DefaultObjectACL) LateInitialize(attrs []byte) (bool, error) {
@@ -683,6 +894,36 @@ func (tr *Notification) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Notification
+func (tr *Notification) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Notification using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Notification) LateInitialize(attrs []byte) (bool, error) {
@@ -767,6 +1008,36 @@ func (tr *ObjectAccessControl) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ObjectAccessControl
+func (tr *ObjectAccessControl) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ObjectAccessControl using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ObjectAccessControl) LateInitialize(attrs []byte) (bool, error) {
@@ -851,6 +1122,36 @@ func (tr *ObjectACL) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this ObjectACL
+func (tr *ObjectACL) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this ObjectACL using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *ObjectACL) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/storage/v1beta1/zz_notification_types.go b/apis/storage/v1beta1/zz_notification_types.go
index 158f8da2b..5f8dde2c6 100755
--- a/apis/storage/v1beta1/zz_notification_types.go
+++ b/apis/storage/v1beta1/zz_notification_types.go
@@ -32,9 +32,11 @@ import (
 type NotificationInitParameters struct {
 
 	// A set of key/value attribute pairs to attach to each Cloud PubSub message published for this notification subscription
+	// +mapType=granular
 	CustomAttributes map[string]*string `json:"customAttributes,omitempty" tf:"custom_attributes,omitempty"`
 
 	// List of event type filters for this notification config. If not specified, Cloud Storage will send notifications for all event types. The valid types are: "OBJECT_FINALIZE", "OBJECT_METADATA_UPDATE", "OBJECT_DELETE", "OBJECT_ARCHIVE"
+	// +listType=set
 	EventTypes []*string `json:"eventTypes,omitempty" tf:"event_types,omitempty"`
 
 	// Specifies a prefix path filter for this notification config. Cloud Storage will only send notifications for objects in this bucket whose names begin with the specified prefix.
@@ -50,9 +52,11 @@ type NotificationObservation struct {
 	Bucket *string `json:"bucket,omitempty" tf:"bucket,omitempty"`
 
 	// A set of key/value attribute pairs to attach to each Cloud PubSub message published for this notification subscription
+	// +mapType=granular
 	CustomAttributes map[string]*string `json:"customAttributes,omitempty" tf:"custom_attributes,omitempty"`
 
 	// List of event type filters for this notification config. If not specified, Cloud Storage will send notifications for all event types. The valid types are: "OBJECT_FINALIZE", "OBJECT_METADATA_UPDATE", "OBJECT_DELETE", "OBJECT_ARCHIVE"
+	// +listType=set
 	EventTypes []*string `json:"eventTypes,omitempty" tf:"event_types,omitempty"`
 
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
@@ -93,10 +97,12 @@ type NotificationParameters struct {
 
 	// A set of key/value attribute pairs to attach to each Cloud PubSub message published for this notification subscription
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	CustomAttributes map[string]*string `json:"customAttributes,omitempty" tf:"custom_attributes,omitempty"`
 
 	// List of event type filters for this notification config. If not specified, Cloud Storage will send notifications for all event types. The valid types are: "OBJECT_FINALIZE", "OBJECT_METADATA_UPDATE", "OBJECT_DELETE", "OBJECT_ARCHIVE"
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	EventTypes []*string `json:"eventTypes,omitempty" tf:"event_types,omitempty"`
 
 	// Specifies a prefix path filter for this notification config. Cloud Storage will only send notifications for objects in this bucket whose names begin with the specified prefix.
diff --git a/apis/storage/v1beta1/zz_objectacl_types.go b/apis/storage/v1beta1/zz_objectacl_types.go
index 0a6e69320..a68faecac 100755
--- a/apis/storage/v1beta1/zz_objectacl_types.go
+++ b/apis/storage/v1beta1/zz_objectacl_types.go
@@ -36,6 +36,7 @@ type ObjectACLInitParameters struct {
 
 	// List of role/entity pairs in the form ROLE:entity. See GCS Object ACL documentation for more details.
 	// Must be set if predefined_acl is not.
+	// +listType=set
 	RoleEntity []*string `json:"roleEntity,omitempty" tf:"role_entity,omitempty"`
 }
 
@@ -54,6 +55,7 @@ type ObjectACLObservation struct {
 
 	// List of role/entity pairs in the form ROLE:entity. See GCS Object ACL documentation for more details.
 	// Must be set if predefined_acl is not.
+	// +listType=set
 	RoleEntity []*string `json:"roleEntity,omitempty" tf:"role_entity,omitempty"`
 }
 
@@ -93,6 +95,7 @@ type ObjectACLParameters struct {
 	// List of role/entity pairs in the form ROLE:entity. See GCS Object ACL documentation for more details.
 	// Must be set if predefined_acl is not.
 	// +kubebuilder:validation:Optional
+	// +listType=set
 	RoleEntity []*string `json:"roleEntity,omitempty" tf:"role_entity,omitempty"`
 }
 
diff --git a/apis/storagetransfer/v1beta1/zz_generated_terraformed.go b/apis/storagetransfer/v1beta1/zz_generated_terraformed.go
index 72f6c9001..00ae566c7 100755
--- a/apis/storagetransfer/v1beta1/zz_generated_terraformed.go
+++ b/apis/storagetransfer/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *AgentPool) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this AgentPool
+func (tr *AgentPool) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this AgentPool using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *AgentPool) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/tpu/v1beta1/zz_generated_terraformed.go b/apis/tpu/v1beta1/zz_generated_terraformed.go
index e91b7a083..d15c7c2af 100755
--- a/apis/tpu/v1beta1/zz_generated_terraformed.go
+++ b/apis/tpu/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Node) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Node
+func (tr *Node) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Node using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Node) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/tpu/v1beta1/zz_node_types.go b/apis/tpu/v1beta1/zz_node_types.go
index b624deab9..b1ff09c53 100755
--- a/apis/tpu/v1beta1/zz_node_types.go
+++ b/apis/tpu/v1beta1/zz_node_types.go
@@ -65,6 +65,7 @@ type NodeInitParameters struct {
 	Description *string `json:"description,omitempty" tf:"description,omitempty"`
 
 	// Resource labels to represent user provided metadata.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -107,6 +108,7 @@ type NodeObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// Resource labels to represent user provided metadata.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The name of a network to peer the TPU node to. It must be a
@@ -171,6 +173,7 @@ type NodeParameters struct {
 
 	// Resource labels to represent user provided metadata.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The name of a network to peer the TPU node to. It must be a
diff --git a/apis/vertexai/v1beta1/zz_dataset_types.go b/apis/vertexai/v1beta1/zz_dataset_types.go
index 63c7085bc..5eed554f5 100755
--- a/apis/vertexai/v1beta1/zz_dataset_types.go
+++ b/apis/vertexai/v1beta1/zz_dataset_types.go
@@ -39,6 +39,7 @@ type DatasetInitParameters struct {
 	EncryptionSpec []EncryptionSpecInitParameters `json:"encryptionSpec,omitempty" tf:"encryption_spec,omitempty"`
 
 	// A set of key/value label pairs to assign to this Workflow.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Points to a YAML file stored on Google Cloud Storage describing additional information about the Dataset. The schema is defined as an OpenAPI 3.0.2 Schema Object. The schema files that can be used here are found in gs://google-cloud-aiplatform/schema/dataset/metadata/.
@@ -68,6 +69,7 @@ type DatasetObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// A set of key/value label pairs to assign to this Workflow.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Points to a YAML file stored on Google Cloud Storage describing additional information about the Dataset. The schema is defined as an OpenAPI 3.0.2 Schema Object. The schema files that can be used here are found in gs://google-cloud-aiplatform/schema/dataset/metadata/.
@@ -100,6 +102,7 @@ type DatasetParameters struct {
 
 	// A set of key/value label pairs to assign to this Workflow.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Points to a YAML file stored on Google Cloud Storage describing additional information about the Dataset. The schema is defined as an OpenAPI 3.0.2 Schema Object. The schema files that can be used here are found in gs://google-cloud-aiplatform/schema/dataset/metadata/.
diff --git a/apis/vertexai/v1beta1/zz_featurestore_types.go b/apis/vertexai/v1beta1/zz_featurestore_types.go
index f6b8afef5..40b4c2a97 100755
--- a/apis/vertexai/v1beta1/zz_featurestore_types.go
+++ b/apis/vertexai/v1beta1/zz_featurestore_types.go
@@ -58,6 +58,7 @@ type FeaturestoreInitParameters struct {
 	ForceDestroy *bool `json:"forceDestroy,omitempty" tf:"force_destroy,omitempty"`
 
 	// A set of key/value label pairs to assign to this Featurestore.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The name of the Featurestore. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number.
@@ -94,6 +95,7 @@ type FeaturestoreObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// A set of key/value label pairs to assign to this Featurestore.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The name of the Featurestore. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number.
@@ -127,6 +129,7 @@ type FeaturestoreParameters struct {
 
 	// A set of key/value label pairs to assign to this Featurestore.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The name of the Featurestore. This value may be up to 60 characters, and valid characters are [a-z0-9_]. The first character cannot be a number.
diff --git a/apis/vertexai/v1beta1/zz_featurestoreentitytype_types.go b/apis/vertexai/v1beta1/zz_featurestoreentitytype_types.go
index 2ed1666f3..f0d4cd691 100755
--- a/apis/vertexai/v1beta1/zz_featurestoreentitytype_types.go
+++ b/apis/vertexai/v1beta1/zz_featurestoreentitytype_types.go
@@ -54,6 +54,7 @@ type FeaturestoreEntitytypeInitParameters struct {
 	Description *string `json:"description,omitempty" tf:"description,omitempty"`
 
 	// A set of key/value label pairs to assign to this EntityType.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The default monitoring configuration for all Features under this EntityType.
@@ -83,6 +84,7 @@ type FeaturestoreEntitytypeObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// A set of key/value label pairs to assign to this EntityType.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The default monitoring configuration for all Features under this EntityType.
@@ -121,6 +123,7 @@ type FeaturestoreEntitytypeParameters struct {
 
 	// A set of key/value label pairs to assign to this EntityType.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The default monitoring configuration for all Features under this EntityType.
diff --git a/apis/vertexai/v1beta1/zz_generated_terraformed.go b/apis/vertexai/v1beta1/zz_generated_terraformed.go
index 76bc47fe0..f0d84243b 100755
--- a/apis/vertexai/v1beta1/zz_generated_terraformed.go
+++ b/apis/vertexai/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Dataset) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Dataset
+func (tr *Dataset) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Dataset using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Dataset) LateInitialize(attrs []byte) (bool, error) {
@@ -179,6 +210,36 @@ func (tr *Featurestore) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Featurestore
+func (tr *Featurestore) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Featurestore using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Featurestore) LateInitialize(attrs []byte) (bool, error) {
@@ -263,6 +324,36 @@ func (tr *FeaturestoreEntitytype) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this FeaturestoreEntitytype
+func (tr *FeaturestoreEntitytype) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this FeaturestoreEntitytype using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *FeaturestoreEntitytype) LateInitialize(attrs []byte) (bool, error) {
@@ -347,6 +438,36 @@ func (tr *Tensorboard) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Tensorboard
+func (tr *Tensorboard) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Tensorboard using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Tensorboard) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/vertexai/v1beta1/zz_tensorboard_types.go b/apis/vertexai/v1beta1/zz_tensorboard_types.go
index e56fab082..b2a007bb1 100755
--- a/apis/vertexai/v1beta1/zz_tensorboard_types.go
+++ b/apis/vertexai/v1beta1/zz_tensorboard_types.go
@@ -61,6 +61,7 @@ type TensorboardInitParameters struct {
 	EncryptionSpec []TensorboardEncryptionSpecInitParameters `json:"encryptionSpec,omitempty" tf:"encryption_spec,omitempty"`
 
 	// The labels with user-defined metadata to organize your Tensorboards.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
@@ -87,6 +88,7 @@ type TensorboardObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// The labels with user-defined metadata to organize your Tensorboards.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Name of the Tensorboard.
@@ -119,6 +121,7 @@ type TensorboardParameters struct {
 
 	// The labels with user-defined metadata to organize your Tensorboards.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// The ID of the project in which the resource belongs.
diff --git a/apis/vpcaccess/v1beta1/zz_generated_terraformed.go b/apis/vpcaccess/v1beta1/zz_generated_terraformed.go
index 807807cca..c778d6dce 100755
--- a/apis/vpcaccess/v1beta1/zz_generated_terraformed.go
+++ b/apis/vpcaccess/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Connector) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Connector
+func (tr *Connector) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Connector using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Connector) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/workflows/v1beta1/zz_generated_terraformed.go b/apis/workflows/v1beta1/zz_generated_terraformed.go
index 1ba949b6f..db702be58 100755
--- a/apis/workflows/v1beta1/zz_generated_terraformed.go
+++ b/apis/workflows/v1beta1/zz_generated_terraformed.go
@@ -23,6 +23,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	"dario.cat/mergo"
 	"github.com/pkg/errors"
 
 	"github.com/crossplane/upjet/pkg/resource"
@@ -95,6 +96,36 @@ func (tr *Workflow) GetInitParameters() (map[string]any, error) {
 	return base, json.TFParser.Unmarshal(p, &base)
 }
 
+// GetInitParameters of this Workflow
+func (tr *Workflow) GetMergedParameters(shouldMergeInitProvider bool) (map[string]any, error) {
+	params, err := tr.GetParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get parameters for resource '%q'", tr.GetName())
+	}
+	if !shouldMergeInitProvider {
+		return params, nil
+	}
+
+	initParams, err := tr.GetInitParameters()
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get init parameters for resource '%q'", tr.GetName())
+	}
+
+	// Note(lsviben): mergo.WithSliceDeepCopy is needed to merge the
+	// slices from the initProvider to forProvider. As it also sets
+	// overwrite to true, we need to set it back to false, we don't
+	// want to overwrite the forProvider fields with the initProvider
+	// fields.
+	err = mergo.Merge(&params, initParams, mergo.WithSliceDeepCopy, func(c *mergo.Config) {
+		c.Overwrite = false
+	})
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot merge spec.initProvider and spec.forProvider parameters for resource '%q'", tr.GetName())
+	}
+
+	return params, nil
+}
+
 // LateInitialize this Workflow using its observed tfState.
 // returns True if there are any spec changes for the resource.
 func (tr *Workflow) LateInitialize(attrs []byte) (bool, error) {
diff --git a/apis/workflows/v1beta1/zz_workflow_types.go b/apis/workflows/v1beta1/zz_workflow_types.go
index 03698221f..0be2748c0 100755
--- a/apis/workflows/v1beta1/zz_workflow_types.go
+++ b/apis/workflows/v1beta1/zz_workflow_types.go
@@ -39,6 +39,7 @@ type WorkflowInitParameters struct {
 	Description *string `json:"description,omitempty" tf:"description,omitempty"`
 
 	// A set of key/value label pairs to assign to this Workflow.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Name of the Workflow.
@@ -75,6 +76,7 @@ type WorkflowObservation struct {
 	ID *string `json:"id,omitempty" tf:"id,omitempty"`
 
 	// A set of key/value label pairs to assign to this Workflow.
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Name of the Workflow.
@@ -126,6 +128,7 @@ type WorkflowParameters struct {
 
 	// A set of key/value label pairs to assign to this Workflow.
 	// +kubebuilder:validation:Optional
+	// +mapType=granular
 	Labels map[string]*string `json:"labels,omitempty" tf:"labels,omitempty"`
 
 	// Name of the Workflow.
diff --git a/build b/build
index a6e25afa0..2672eeb76 160000
--- a/build
+++ b/build
@@ -1 +1 @@
-Subproject commit a6e25afa0d43da62b11af96a5d29627a52f32cd9
+Subproject commit 2672eeb767636ec837aa7c63cd7e26e6089fa810
diff --git a/cmd/generator/main.go b/cmd/generator/main.go
index 45fb45fa6..5771e0d00 100644
--- a/cmd/generator/main.go
+++ b/cmd/generator/main.go
@@ -15,6 +15,7 @@
 package main
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"os"
@@ -42,7 +43,8 @@ func main() {
 	if err != nil {
 		panic(fmt.Sprintf("cannot calculate the absolute path with %s", *repoRoot))
 	}
-	p := config.GetProvider()
+	p, err := config.GetProvider(context.Background(), true)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	dumpGeneratedResourceList(p, generatedResourceList)
 	dumpSkippedResourcesCSV(p, skippedResourcesCSV)
 	pipeline.Run(p, absRootDir)
diff --git a/cmd/provider/accesscontextmanager/zz_main.go b/cmd/provider/accesscontextmanager/zz_main.go
index 1b6ce8e72..010bc064d 100644
--- a/cmd/provider/accesscontextmanager/zz_main.go
+++ b/cmd/provider/accesscontextmanager/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_accesscontextmanager(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/activedirectory/zz_main.go b/cmd/provider/activedirectory/zz_main.go
index b5ffbbf30..9cf57382e 100644
--- a/cmd/provider/activedirectory/zz_main.go
+++ b/cmd/provider/activedirectory/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_activedirectory(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/alloydb/zz_main.go b/cmd/provider/alloydb/zz_main.go
index a3d106d03..ca3573029 100644
--- a/cmd/provider/alloydb/zz_main.go
+++ b/cmd/provider/alloydb/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_alloydb(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/apigee/zz_main.go b/cmd/provider/apigee/zz_main.go
index 4f20d0654..81907c7d2 100644
--- a/cmd/provider/apigee/zz_main.go
+++ b/cmd/provider/apigee/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_apigee(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/appengine/zz_main.go b/cmd/provider/appengine/zz_main.go
index 0e1a2d731..02cf303c0 100644
--- a/cmd/provider/appengine/zz_main.go
+++ b/cmd/provider/appengine/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_appengine(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/artifact/zz_main.go b/cmd/provider/artifact/zz_main.go
index 5f999df3c..d352b30c3 100644
--- a/cmd/provider/artifact/zz_main.go
+++ b/cmd/provider/artifact/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_artifact(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/beyondcorp/zz_main.go b/cmd/provider/beyondcorp/zz_main.go
index d4bdd9447..6062244c5 100644
--- a/cmd/provider/beyondcorp/zz_main.go
+++ b/cmd/provider/beyondcorp/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_beyondcorp(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/bigquery/zz_main.go b/cmd/provider/bigquery/zz_main.go
index 8a2203d81..fa8dfb87d 100644
--- a/cmd/provider/bigquery/zz_main.go
+++ b/cmd/provider/bigquery/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_bigquery(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/bigtable/zz_main.go b/cmd/provider/bigtable/zz_main.go
index b7eaf2307..dbeac8993 100644
--- a/cmd/provider/bigtable/zz_main.go
+++ b/cmd/provider/bigtable/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_bigtable(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/binaryauthorization/zz_main.go b/cmd/provider/binaryauthorization/zz_main.go
index e4ecd3b5d..433445493 100644
--- a/cmd/provider/binaryauthorization/zz_main.go
+++ b/cmd/provider/binaryauthorization/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_binaryauthorization(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/certificatemanager/zz_main.go b/cmd/provider/certificatemanager/zz_main.go
index 737d5d701..81a7a2142 100644
--- a/cmd/provider/certificatemanager/zz_main.go
+++ b/cmd/provider/certificatemanager/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_certificatemanager(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/cloud/zz_main.go b/cmd/provider/cloud/zz_main.go
index ba55aef7a..3aabb2d96 100644
--- a/cmd/provider/cloud/zz_main.go
+++ b/cmd/provider/cloud/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_cloud(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/cloudbuild/zz_main.go b/cmd/provider/cloudbuild/zz_main.go
index c14c3accf..4701dc3b6 100644
--- a/cmd/provider/cloudbuild/zz_main.go
+++ b/cmd/provider/cloudbuild/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_cloudbuild(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/cloudfunctions/zz_main.go b/cmd/provider/cloudfunctions/zz_main.go
index be3f83618..6609023fc 100644
--- a/cmd/provider/cloudfunctions/zz_main.go
+++ b/cmd/provider/cloudfunctions/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_cloudfunctions(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/cloudfunctions2/zz_main.go b/cmd/provider/cloudfunctions2/zz_main.go
index 8c6bdbead..019af089d 100644
--- a/cmd/provider/cloudfunctions2/zz_main.go
+++ b/cmd/provider/cloudfunctions2/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_cloudfunctions2(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/cloudiot/zz_main.go b/cmd/provider/cloudiot/zz_main.go
index 4356ee0c8..44607be1d 100644
--- a/cmd/provider/cloudiot/zz_main.go
+++ b/cmd/provider/cloudiot/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_cloudiot(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/cloudplatform/zz_main.go b/cmd/provider/cloudplatform/zz_main.go
index ad50e83d2..640ec5320 100644
--- a/cmd/provider/cloudplatform/zz_main.go
+++ b/cmd/provider/cloudplatform/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_cloudplatform(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/cloudrun/zz_main.go b/cmd/provider/cloudrun/zz_main.go
index ace518561..d7e01fe07 100644
--- a/cmd/provider/cloudrun/zz_main.go
+++ b/cmd/provider/cloudrun/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_cloudrun(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/cloudscheduler/zz_main.go b/cmd/provider/cloudscheduler/zz_main.go
index 7d82c6d29..7646a678b 100644
--- a/cmd/provider/cloudscheduler/zz_main.go
+++ b/cmd/provider/cloudscheduler/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_cloudscheduler(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/cloudtasks/zz_main.go b/cmd/provider/cloudtasks/zz_main.go
index 808168435..5ae2115f0 100644
--- a/cmd/provider/cloudtasks/zz_main.go
+++ b/cmd/provider/cloudtasks/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_cloudtasks(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/composer/zz_main.go b/cmd/provider/composer/zz_main.go
index 3777dd71f..c9066b417 100644
--- a/cmd/provider/composer/zz_main.go
+++ b/cmd/provider/composer/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_composer(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/compute/zz_main.go b/cmd/provider/compute/zz_main.go
index 5e3935230..ab9d06e80 100644
--- a/cmd/provider/compute/zz_main.go
+++ b/cmd/provider/compute/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_compute(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/config/zz_main.go b/cmd/provider/config/zz_main.go
index 629a2851a..4cd223b6c 100644
--- a/cmd/provider/config/zz_main.go
+++ b/cmd/provider/config/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_config(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/container/zz_main.go b/cmd/provider/container/zz_main.go
index d16bdc946..ea8e29e3d 100644
--- a/cmd/provider/container/zz_main.go
+++ b/cmd/provider/container/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_container(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/containeranalysis/zz_main.go b/cmd/provider/containeranalysis/zz_main.go
index 75eb949ea..4f0113b5f 100644
--- a/cmd/provider/containeranalysis/zz_main.go
+++ b/cmd/provider/containeranalysis/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_containeranalysis(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/containeraws/zz_main.go b/cmd/provider/containeraws/zz_main.go
index f436b6598..d6bc15ee4 100644
--- a/cmd/provider/containeraws/zz_main.go
+++ b/cmd/provider/containeraws/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_containeraws(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/containerazure/zz_main.go b/cmd/provider/containerazure/zz_main.go
index 990fb7bf8..249607dd3 100644
--- a/cmd/provider/containerazure/zz_main.go
+++ b/cmd/provider/containerazure/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_containerazure(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/datacatalog/zz_main.go b/cmd/provider/datacatalog/zz_main.go
index 695222e9b..5f40a33ad 100644
--- a/cmd/provider/datacatalog/zz_main.go
+++ b/cmd/provider/datacatalog/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_datacatalog(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/dataflow/zz_main.go b/cmd/provider/dataflow/zz_main.go
index 4cdadeb30..52191d93b 100644
--- a/cmd/provider/dataflow/zz_main.go
+++ b/cmd/provider/dataflow/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_dataflow(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/datafusion/zz_main.go b/cmd/provider/datafusion/zz_main.go
index 19d43a9c1..b304b2b09 100644
--- a/cmd/provider/datafusion/zz_main.go
+++ b/cmd/provider/datafusion/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_datafusion(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/datalossprevention/zz_main.go b/cmd/provider/datalossprevention/zz_main.go
index aeb99da8a..ca7adac90 100644
--- a/cmd/provider/datalossprevention/zz_main.go
+++ b/cmd/provider/datalossprevention/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_datalossprevention(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/dataplex/zz_main.go b/cmd/provider/dataplex/zz_main.go
index c65c00e3e..b8322e86b 100644
--- a/cmd/provider/dataplex/zz_main.go
+++ b/cmd/provider/dataplex/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_dataplex(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/dataproc/zz_main.go b/cmd/provider/dataproc/zz_main.go
index 913dd502b..1111b0ad8 100644
--- a/cmd/provider/dataproc/zz_main.go
+++ b/cmd/provider/dataproc/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_dataproc(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/datastore/zz_main.go b/cmd/provider/datastore/zz_main.go
index 2a298d792..af7e65f43 100644
--- a/cmd/provider/datastore/zz_main.go
+++ b/cmd/provider/datastore/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_datastore(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/datastream/zz_main.go b/cmd/provider/datastream/zz_main.go
index 4a3235e83..f8b1442b7 100644
--- a/cmd/provider/datastream/zz_main.go
+++ b/cmd/provider/datastream/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_datastream(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/dialogflowcx/zz_main.go b/cmd/provider/dialogflowcx/zz_main.go
index 435535ed5..d7faac84c 100644
--- a/cmd/provider/dialogflowcx/zz_main.go
+++ b/cmd/provider/dialogflowcx/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_dialogflowcx(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/dns/zz_main.go b/cmd/provider/dns/zz_main.go
index 6228a363a..c153b6aa0 100644
--- a/cmd/provider/dns/zz_main.go
+++ b/cmd/provider/dns/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_dns(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/documentai/zz_main.go b/cmd/provider/documentai/zz_main.go
index ac73c1604..87c2279de 100644
--- a/cmd/provider/documentai/zz_main.go
+++ b/cmd/provider/documentai/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_documentai(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/essentialcontacts/zz_main.go b/cmd/provider/essentialcontacts/zz_main.go
index 918a0d941..a88177259 100644
--- a/cmd/provider/essentialcontacts/zz_main.go
+++ b/cmd/provider/essentialcontacts/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_essentialcontacts(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/eventarc/zz_main.go b/cmd/provider/eventarc/zz_main.go
index 0ca17ac39..bb37be1cb 100644
--- a/cmd/provider/eventarc/zz_main.go
+++ b/cmd/provider/eventarc/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_eventarc(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/filestore/zz_main.go b/cmd/provider/filestore/zz_main.go
index 8eebe2301..9848ff5b4 100644
--- a/cmd/provider/filestore/zz_main.go
+++ b/cmd/provider/filestore/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_filestore(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/firebaserules/zz_main.go b/cmd/provider/firebaserules/zz_main.go
index 79c4c5606..d32915ff2 100644
--- a/cmd/provider/firebaserules/zz_main.go
+++ b/cmd/provider/firebaserules/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_firebaserules(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/gke/zz_main.go b/cmd/provider/gke/zz_main.go
index 58835fd59..da2b0948a 100644
--- a/cmd/provider/gke/zz_main.go
+++ b/cmd/provider/gke/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_gke(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/gkehub/zz_main.go b/cmd/provider/gkehub/zz_main.go
index c8e9d3826..f9bd5ebbe 100644
--- a/cmd/provider/gkehub/zz_main.go
+++ b/cmd/provider/gkehub/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_gkehub(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/healthcare/zz_main.go b/cmd/provider/healthcare/zz_main.go
index e74eb039d..a1dbfb908 100644
--- a/cmd/provider/healthcare/zz_main.go
+++ b/cmd/provider/healthcare/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_healthcare(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/iam/zz_main.go b/cmd/provider/iam/zz_main.go
index 3c90fe65a..06076cf6a 100644
--- a/cmd/provider/iam/zz_main.go
+++ b/cmd/provider/iam/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_iam(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/iap/zz_main.go b/cmd/provider/iap/zz_main.go
index f6369f38b..2655d6e3d 100644
--- a/cmd/provider/iap/zz_main.go
+++ b/cmd/provider/iap/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_iap(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/identityplatform/zz_main.go b/cmd/provider/identityplatform/zz_main.go
index 7fe0c83a9..2dc145c0c 100644
--- a/cmd/provider/identityplatform/zz_main.go
+++ b/cmd/provider/identityplatform/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_identityplatform(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/kms/zz_main.go b/cmd/provider/kms/zz_main.go
index b5482180f..e4d016262 100644
--- a/cmd/provider/kms/zz_main.go
+++ b/cmd/provider/kms/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_kms(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/logging/zz_main.go b/cmd/provider/logging/zz_main.go
index 0160803c8..152426676 100644
--- a/cmd/provider/logging/zz_main.go
+++ b/cmd/provider/logging/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_logging(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/memcache/zz_main.go b/cmd/provider/memcache/zz_main.go
index 8694c5d45..a4538dab0 100644
--- a/cmd/provider/memcache/zz_main.go
+++ b/cmd/provider/memcache/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_memcache(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/mlengine/zz_main.go b/cmd/provider/mlengine/zz_main.go
index 39b05600b..7c4ac6aaa 100644
--- a/cmd/provider/mlengine/zz_main.go
+++ b/cmd/provider/mlengine/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_mlengine(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/monitoring/zz_main.go b/cmd/provider/monitoring/zz_main.go
index c1fa2d9ef..6a4822aed 100644
--- a/cmd/provider/monitoring/zz_main.go
+++ b/cmd/provider/monitoring/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_monitoring(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/monolith/zz_main.go b/cmd/provider/monolith/zz_main.go
index 7ed804fc3..fa1957953 100644
--- a/cmd/provider/monolith/zz_main.go
+++ b/cmd/provider/monolith/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_monolith(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/networkconnectivity/zz_main.go b/cmd/provider/networkconnectivity/zz_main.go
index a4202ce66..842025de6 100644
--- a/cmd/provider/networkconnectivity/zz_main.go
+++ b/cmd/provider/networkconnectivity/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_networkconnectivity(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/networkmanagement/zz_main.go b/cmd/provider/networkmanagement/zz_main.go
index c86e81a89..361be548f 100644
--- a/cmd/provider/networkmanagement/zz_main.go
+++ b/cmd/provider/networkmanagement/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_networkmanagement(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/notebooks/zz_main.go b/cmd/provider/notebooks/zz_main.go
index 95962a43d..668d00031 100644
--- a/cmd/provider/notebooks/zz_main.go
+++ b/cmd/provider/notebooks/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_notebooks(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/osconfig/zz_main.go b/cmd/provider/osconfig/zz_main.go
index b88573cf9..5c9bb49cf 100644
--- a/cmd/provider/osconfig/zz_main.go
+++ b/cmd/provider/osconfig/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_osconfig(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/oslogin/zz_main.go b/cmd/provider/oslogin/zz_main.go
index 23269edbc..9d012d7b6 100644
--- a/cmd/provider/oslogin/zz_main.go
+++ b/cmd/provider/oslogin/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_oslogin(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/privateca/zz_main.go b/cmd/provider/privateca/zz_main.go
index 3b1b89932..72f4fd2aa 100644
--- a/cmd/provider/privateca/zz_main.go
+++ b/cmd/provider/privateca/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_privateca(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/pubsub/zz_main.go b/cmd/provider/pubsub/zz_main.go
index 50b567d52..97bed64eb 100644
--- a/cmd/provider/pubsub/zz_main.go
+++ b/cmd/provider/pubsub/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_pubsub(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/redis/zz_main.go b/cmd/provider/redis/zz_main.go
index 6bb85bec0..85832c812 100644
--- a/cmd/provider/redis/zz_main.go
+++ b/cmd/provider/redis/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_redis(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/secretmanager/zz_main.go b/cmd/provider/secretmanager/zz_main.go
index fe8153163..bdecba41d 100644
--- a/cmd/provider/secretmanager/zz_main.go
+++ b/cmd/provider/secretmanager/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_secretmanager(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/servicenetworking/zz_main.go b/cmd/provider/servicenetworking/zz_main.go
index a50712250..58f93196a 100644
--- a/cmd/provider/servicenetworking/zz_main.go
+++ b/cmd/provider/servicenetworking/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_servicenetworking(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/sourcerepo/zz_main.go b/cmd/provider/sourcerepo/zz_main.go
index fc4b61926..9c71db775 100644
--- a/cmd/provider/sourcerepo/zz_main.go
+++ b/cmd/provider/sourcerepo/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_sourcerepo(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/spanner/zz_main.go b/cmd/provider/spanner/zz_main.go
index ccbdaaa7a..db0f22799 100644
--- a/cmd/provider/spanner/zz_main.go
+++ b/cmd/provider/spanner/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_spanner(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/sql/zz_main.go b/cmd/provider/sql/zz_main.go
index 22be2c201..174ec2f93 100644
--- a/cmd/provider/sql/zz_main.go
+++ b/cmd/provider/sql/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_sql(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/storage/zz_main.go b/cmd/provider/storage/zz_main.go
index cca138962..1b26a6a82 100644
--- a/cmd/provider/storage/zz_main.go
+++ b/cmd/provider/storage/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_storage(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/storagetransfer/zz_main.go b/cmd/provider/storagetransfer/zz_main.go
index 0b3c3e7b7..087eabc4c 100644
--- a/cmd/provider/storagetransfer/zz_main.go
+++ b/cmd/provider/storagetransfer/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_storagetransfer(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/tpu/zz_main.go b/cmd/provider/tpu/zz_main.go
index fd1a5fbcb..e0245e0f2 100644
--- a/cmd/provider/tpu/zz_main.go
+++ b/cmd/provider/tpu/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_tpu(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/vertexai/zz_main.go b/cmd/provider/vertexai/zz_main.go
index 962202c2c..3acb7e64b 100644
--- a/cmd/provider/vertexai/zz_main.go
+++ b/cmd/provider/vertexai/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_vertexai(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/vpcaccess/zz_main.go b/cmd/provider/vpcaccess/zz_main.go
index c522f9a9a..5545fb1e6 100644
--- a/cmd/provider/vpcaccess/zz_main.go
+++ b/cmd/provider/vpcaccess/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_vpcaccess(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/cmd/provider/workflows/zz_main.go b/cmd/provider/workflows/zz_main.go
index 383a6aed6..1142617f3 100644
--- a/cmd/provider/workflows/zz_main.go
+++ b/cmd/provider/workflows/zz_main.go
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_workflows(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/config/cloudrun/config.go b/config/cloudrun/config.go
index 92f57e762..fc6b92820 100644
--- a/config/cloudrun/config.go
+++ b/config/cloudrun/config.go
@@ -2,6 +2,7 @@ package cloudrun
 
 import (
 	"github.com/crossplane/upjet/pkg/config"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
 )
 
 // Configure configures individual resources by adding custom
@@ -58,6 +59,18 @@ func Configure(p *config.Provider) {
 	p.AddResourceConfigurator("google_cloud_run_v2_job", func(r *config.Resource) {
 		// This prevents an import cycle not allowed error
 		delete(r.References, "template.template.vpc_access.connector")
+		r.TerraformCustomDiff = func(diff *terraform.InstanceDiff, _ *terraform.InstanceState, _ *terraform.ResourceConfig) (*terraform.InstanceDiff, error) {
+			if diff != nil {
+				// The Terraform registry docs state that when
+				// the `launch_stage` configuration argument
+				// is set, the attribute may differ from it.
+				// Thus, the provided example manifests
+				// ignore changes to this argument using
+				// the`ignore_changes` lifecycle meta-argument.
+				delete(diff.Attributes, "launch_stage")
+			}
+			return diff, nil
+		}
 	})
 	p.AddResourceConfigurator("google_cloud_run_v2_service", func(r *config.Resource) {
 		// This prevents an import cycle not allowed error
diff --git a/config/common/config.go b/config/common/config.go
index e0524074e..904c2584b 100644
--- a/config/common/config.go
+++ b/config/common/config.go
@@ -22,6 +22,9 @@ const (
 	ExtractResourceIDFuncPath = "github.com/upbound/provider-gcp/config/common.ExtractResourceID()"
 	ExtractProjectIDFuncPath  = "github.com/upbound/provider-gcp/config/common.ExtractProjectID()"
 	ExtractFolderIDFuncPath   = "github.com/upbound/provider-gcp/config/common.ExtractFolderID()"
+	// VersionV1Beta1 is used for resources that meet the v1beta1 criteria
+	// here: https://github.com/upbound/arch/pull/33
+	VersionV1Beta1 = "v1beta1"
 )
 
 var (
diff --git a/config/compute/config.go b/config/compute/config.go
index fd47de226..634e47eaa 100644
--- a/config/compute/config.go
+++ b/config/compute/config.go
@@ -6,6 +6,7 @@ import (
 	"github.com/crossplane/crossplane-runtime/pkg/resource"
 	"github.com/crossplane/upjet/pkg/config"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
 
 	"github.com/upbound/provider-gcp/config/common"
 )
@@ -130,6 +131,16 @@ func Configure(p *config.Provider) { //nolint: gocyclo
 		r.References["network_interface.subnetwork"] = config.Reference{
 			Type: "Subnetwork",
 		}
+
+		r.TerraformCustomDiff = func(diff *terraform.InstanceDiff, _ *terraform.InstanceState, _ *terraform.ResourceConfig) (*terraform.InstanceDiff, error) {
+			if diff == nil || diff.Destroy {
+				return diff, nil
+			}
+			if cicDiff, ok := diff.Attributes["confidential_instance_config.#"]; ok && cicDiff.Old == "" && cicDiff.New == "" {
+				delete(diff.Attributes, "confidential_instance_config.#")
+			}
+			return diff, nil
+		}
 	})
 
 	p.AddResourceConfigurator("google_compute_instance", func(r *config.Resource) {
@@ -179,6 +190,15 @@ func Configure(p *config.Provider) { //nolint: gocyclo
 		r.References["network_interface.subnetwork"] = config.Reference{
 			Type: "Subnetwork",
 		}
+		r.TerraformCustomDiff = func(diff *terraform.InstanceDiff, _ *terraform.InstanceState, _ *terraform.ResourceConfig) (*terraform.InstanceDiff, error) {
+			if diff == nil || diff.Destroy {
+				return diff, nil
+			}
+			if paramsDiff, ok := diff.Attributes["params.#"]; ok && paramsDiff.Old == "" && paramsDiff.New == "" {
+				delete(diff.Attributes, "params.#")
+			}
+			return diff, nil
+		}
 	})
 
 	p.AddResourceConfigurator("google_compute_instance_group", func(r *config.Resource) {
@@ -382,6 +402,12 @@ func Configure(p *config.Provider) { //nolint: gocyclo
 
 	p.AddResourceConfigurator("google_compute_reservation", func(r *config.Resource) {
 		config.MarkAsRequired(r.TerraformResource, "zone")
+		r.TerraformCustomDiff = func(diff *terraform.InstanceDiff, _ *terraform.InstanceState, _ *terraform.ResourceConfig) (*terraform.InstanceDiff, error) {
+			if diff != nil {
+				delete(diff.Attributes, "share_settings.#")
+			}
+			return diff, nil
+		}
 	})
 
 	p.AddResourceConfigurator("google_compute_firewall_policy_association", func(r *config.Resource) {
diff --git a/config/container/config.go b/config/container/config.go
index 11c013988..1c4b5241a 100644
--- a/config/container/config.go
+++ b/config/container/config.go
@@ -4,6 +4,8 @@ import (
 	"encoding/base64"
 	"net/url"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+
 	"github.com/crossplane/upjet/pkg/config"
 	"github.com/pkg/errors"
 	"k8s.io/client-go/tools/clientcmd"
@@ -128,5 +130,18 @@ func Configure(p *config.Provider) { //nolint:gocyclo
 			Type:      "Cluster",
 			Extractor: common.ExtractResourceIDFuncPath,
 		}
+
+		r.TerraformCustomDiff = func(diff *terraform.InstanceDiff, _ *terraform.InstanceState, _ *terraform.ResourceConfig) (*terraform.InstanceDiff, error) {
+			if diff == nil || diff.Destroy {
+				return diff, nil
+			}
+			if ppDiff, ok := diff.Attributes["placement_policy.#"]; ok && ppDiff.Old == "" && ppDiff.New == "" {
+				delete(diff.Attributes, "placement_policy.#")
+			}
+			if asDiff, ok := diff.Attributes["autoscaling.#"]; ok && asDiff.Old == "" && asDiff.New == "" {
+				delete(diff.Attributes, "autoscaling.#")
+			}
+			return diff, nil
+		}
 	})
 }
diff --git a/config/externalname.go b/config/externalname.go
index 37e11cca8..2b6293126 100644
--- a/config/externalname.go
+++ b/config/externalname.go
@@ -6,9 +6,14 @@ package config
 
 import (
 	"github.com/crossplane/upjet/pkg/config"
+
+	"github.com/upbound/provider-gcp/config/common"
 )
 
-var externalNameConfigs = map[string]config.ExternalName{
+// noForkExternalNameConfigs contains all external name configurations
+// belonging to Terraform resources to be reconciled under the no-fork
+// architecture for this provider.
+var noForkExternalNameConfigs = map[string]config.ExternalName{
 	// activedirectory
 	//
 	// Imported by using the following format: {{name}}
@@ -986,6 +991,11 @@ var externalNameConfigs = map[string]config.ExternalName{
 	"google_certificate_manager_certificate_map_entry": config.TemplatedStringAsIdentifier("name", "projects/{{ .setup.configuration.project }}/locations/global/certificateMaps/{{ .parameters.map }}/certificateMapEntries/{{ .external_name }}"),
 }
 
+// cliReconciledExternalNameConfigs contains all external name configurations
+// belonging to Terraform resources to be reconciled under the CLI-based
+// architecture for this provider.
+var cliReconciledExternalNameConfigs = map[string]config.ExternalName{}
+
 // TemplatedStringAsIdentifierWithNoName uses TemplatedStringAsIdentifier but
 // without the name initializer. This allows it to be used in cases where the ID
 // is constructed with parameters and a provider-defined value, meaning no
@@ -997,11 +1007,24 @@ func TemplatedStringAsIdentifierWithNoName(tmpl string) config.ExternalName {
 	return e
 }
 
-func externalNameConfigurations() config.ResourceOption {
+// resourceConfigurator applies all external name configs
+// listed in the table NoForkExternalNameConfigs and
+// cliReconciledExternalNameConfigs and sets the version
+// of those resources to v1beta1. For those resource in
+// noForkExternalNameConfigs, it also sets
+// config.Resource.UseNoForkClient to `true`.
+func resourceConfigurator() config.ResourceOption {
 	return func(r *config.Resource) {
-		if e, ok := externalNameConfigs[r.Name]; ok {
-			r.Version = VersionV1Beta1
-			r.ExternalName = e
+		// if configured both for the no-fork and CLI based architectures,
+		// no-fork configuration prevails
+		e, configured := noForkExternalNameConfigs[r.Name]
+		if !configured {
+			e, configured = cliReconciledExternalNameConfigs[r.Name]
+		}
+		if !configured {
+			return
 		}
+		r.Version = common.VersionV1Beta1
+		r.ExternalName = e
 	}
 }
diff --git a/config/provider.go b/config/provider.go
index ea4b9103d..9c7342238 100644
--- a/config/provider.go
+++ b/config/provider.go
@@ -15,12 +15,18 @@
 package config
 
 import (
+	"context"
 	// Note(ezgidemirel): we are importing this to embed provider schema document
 	_ "embed"
 
 	tjconfig "github.com/crossplane/upjet/pkg/config"
 	"github.com/crossplane/upjet/pkg/registry/reference"
+	conversiontfjson "github.com/crossplane/upjet/pkg/types/conversion/tfjson"
 	"github.com/crossplane/upjet/pkg/types/name"
+	tfjson "github.com/hashicorp/terraform-json"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-google/google/provider"
+	"github.com/pkg/errors"
 
 	"github.com/upbound/provider-gcp/config/accessapproval"
 	"github.com/upbound/provider-gcp/config/accesscontextmanager"
@@ -137,24 +143,59 @@ var skipList = []string{
 	"google_endpoints_service_consumers_iam_binding",
 }
 
+// workaround for the TF Google v4.77.0-based no-fork release: We would like to
+// keep the types in the generated CRDs intact
+// (prevent number->int type replacements).
+func getProviderSchema(s string) (*schema.Provider, error) {
+	ps := tfjson.ProviderSchemas{}
+	if err := ps.UnmarshalJSON([]byte(s)); err != nil {
+		panic(err)
+	}
+	if len(ps.Schemas) != 1 {
+		return nil, errors.Errorf("there should exactly be 1 provider schema but there are %d", len(ps.Schemas))
+	}
+	var rs map[string]*tfjson.Schema
+	for _, v := range ps.Schemas {
+		rs = v.ResourceSchemas
+		break
+	}
+	return &schema.Provider{
+		ResourcesMap: conversiontfjson.GetV2ResourceMap(rs),
+	}, nil
+}
+
 // GetProvider returns provider configuration
-func GetProvider() *tjconfig.Provider {
+func GetProvider(_ context.Context, generationProvider bool) (*tjconfig.Provider, error) {
+	var p *schema.Provider
+	var err error
+	if generationProvider {
+		p, err = getProviderSchema(providerSchema)
+	} else {
+		p = provider.Provider()
+	}
+	if err != nil {
+		return nil, errors.Wrapf(err, "cannot get the Terraform provider schema with generation mode set to %t", generationProvider)
+	}
+
 	pc := tjconfig.NewProvider([]byte(providerSchema), resourcePrefix, modulePath, providerMetadata,
 		tjconfig.WithDefaultResourceOptions(
 			groupOverrides(),
 			externalNameConfig(),
 			defaultVersion(),
-			externalNameConfigurations(),
+			resourceConfigurator(),
 			descriptionOverrides(),
 		),
 		tjconfig.WithRootGroup("gcp.upbound.io"),
 		tjconfig.WithShortName("gcp"),
 		// Comment out the following line to generate all resources.
-		tjconfig.WithIncludeList(resourcesWithExternalNameConfig()),
+		tjconfig.WithIncludeList(resourceList(cliReconciledExternalNameConfigs)),
+		tjconfig.WithNoForkIncludeList(resourceList(noForkExternalNameConfigs)),
 		tjconfig.WithReferenceInjectors([]tjconfig.ReferenceInjector{reference.NewInjector(modulePath)}),
 		tjconfig.WithSkipList(skipList),
 		tjconfig.WithFeaturesPackage("internal/features"),
-		tjconfig.WithMainTemplate(hack.MainTemplate))
+		tjconfig.WithMainTemplate(hack.MainTemplate),
+		tjconfig.WithTerraformProvider(p),
+	)
 
 	for _, configure := range []func(provider *tjconfig.Provider){
 		accessapproval.Configure,
@@ -207,15 +248,15 @@ func GetProvider() *tjconfig.Provider {
 	}
 
 	pc.ConfigureResources()
-	return pc
+	return pc, nil
 }
 
-// resourcesWithExternalNameConfig returns the list of resources that have external
-// name configured in ExternalNameConfigs table.
-func resourcesWithExternalNameConfig() []string {
-	l := make([]string, len(externalNameConfigs))
+// resourceList returns the list of resources that have external
+// name configured in the specified table.
+func resourceList(t map[string]tjconfig.ExternalName) []string {
+	l := make([]string, len(t))
 	i := 0
-	for n := range externalNameConfigs {
+	for n := range t {
 		// Expected format is regex and we'd like to have exact matches.
 		l[i] = n + "$"
 		i++
diff --git a/config/sql/config.go b/config/sql/config.go
index 36e084ee2..787730a98 100644
--- a/config/sql/config.go
+++ b/config/sql/config.go
@@ -115,23 +115,6 @@ func Configure(p *config.Provider) { //nolint:gocyclo
 		}
 	})
 	p.AddResourceConfigurator("google_sql_ssl_cert", func(r *config.Resource) {
-		r.ExternalName = config.IdentifierFromProvider
-		r.ExternalName.GetExternalNameFn = common.GetNameFromFullyQualifiedID
-		r.ExternalName.GetIDFn = func(_ context.Context, externalName string, parameters map[string]interface{}, providerConfig map[string]interface{}) (string, error) {
-			if externalName == "" {
-				return "", nil
-			}
-			project, err := common.GetField(providerConfig, common.KeyProject)
-			if err != nil {
-				return "", err
-			}
-			instance, err := common.GetField(parameters, "instance")
-			if err != nil {
-				return "", err
-			}
-			return fmt.Sprintf("projects/%s/instances/%s/sslCerts/%s", project, instance, externalName), nil
-		}
-
 		r.References["instance"] = config.Reference{
 			Type: "DatabaseInstance",
 		}
diff --git a/examples/bigquery/connection.yaml b/examples/bigquery/connection.yaml
index b5154b707..1f25355a9 100644
--- a/examples/bigquery/connection.yaml
+++ b/examples/bigquery/connection.yaml
@@ -8,6 +8,7 @@ metadata:
   name: connection
 spec:
   forProvider:
+    location: US
     cloudSql:
     - credential:
       - passwordSecretRef:
diff --git a/examples/cloudplatform/projectusageexportbucket.yaml b/examples/cloudplatform/projectusageexportbucket.yaml
index db319ee4b..13b8dd6f6 100644
--- a/examples/cloudplatform/projectusageexportbucket.yaml
+++ b/examples/cloudplatform/projectusageexportbucket.yaml
@@ -22,7 +22,7 @@ metadata:
     meta.upbound.io/example-id: cloudplatform/v1beta1/projectusageexportbucket
   labels:
     testing.upbound.io/example-name: project-usage-tracking-bucket
-  name: project-usage-tracking-bucket
+  name: project-${Rand.RFC1123Subdomain}
 spec:
   forProvider:
     location: US
diff --git a/examples/container/cluster.yaml b/examples/container/cluster.yaml
index 2c3a8169f..590cf2a92 100644
--- a/examples/container/cluster.yaml
+++ b/examples/container/cluster.yaml
@@ -11,4 +11,5 @@ spec:
     location: europe-north1
     ipAllocationPolicy:
       - {}
-    enableAutopilot: true
\ No newline at end of file
+    enableAutopilot: true
+    enableIntranodeVisibility: true
\ No newline at end of file
diff --git a/examples/iam/workloadidentitypool.yaml b/examples/iam/workloadidentitypool.yaml
index 12d159930..fbe551039 100644
--- a/examples/iam/workloadidentitypool.yaml
+++ b/examples/iam/workloadidentitypool.yaml
@@ -3,7 +3,7 @@ kind: WorkloadIdentityPool
 metadata:
   annotations:
     meta.upbound.io/example-id: iam/v1beta1/workloadidentitypool
-    upjet.upbound.io/manual-ntervention: "Needs permissions for Pool creation"
+    upjet.upbound.io/manual-intervention: "Needs permissions for Pool creation"
   labels:
     testing.upbound.io/example-name: work-load-identity
   name: work-load-identity
diff --git a/examples/iam/workloadidentitypoolprovider.yaml b/examples/iam/workloadidentitypoolprovider.yaml
index 2dd13d937..280dbda26 100644
--- a/examples/iam/workloadidentitypoolprovider.yaml
+++ b/examples/iam/workloadidentitypoolprovider.yaml
@@ -21,7 +21,7 @@ kind: WorkloadIdentityPool
 metadata:
   annotations:
     meta.upbound.io/example-id: iam/v1beta1/workloadidentitypoolprovider
-    upjet.upbound.io/manual-ntervention: "Needs permissions for Pool creation"
+    upjet.upbound.io/manual-intervention: "Needs permissions for Pool creation"
   labels:
     testing.upbound.io/example-name: identity-pool
   name: identity-pool
diff --git a/examples/storage/objectacl.yaml b/examples/storage/objectacl.yaml
index d4f0bdd36..f470787f7 100644
--- a/examples/storage/objectacl.yaml
+++ b/examples/storage/objectacl.yaml
@@ -44,7 +44,7 @@ spec:
           - '*'
     forceDestroy: true
     location: US
-    uniformBucketLevelAccess: true
+    uniformBucketLevelAccess: false
     website:
       - mainPageSuffix: index.html
         notFoundPage: 404.html
diff --git a/go.mod b/go.mod
index 105057e1d..a9e9e8b92 100644
--- a/go.mod
+++ b/go.mod
@@ -1,12 +1,15 @@
 module github.com/upbound/provider-gcp
 
-go 1.19
+go 1.21
 
 require (
-	github.com/crossplane/crossplane-runtime v1.14.1
+	dario.cat/mergo v1.0.0
+	github.com/crossplane/crossplane-runtime v1.15.0-rc.0.0.20231213071410-0b379538ab14
 	github.com/crossplane/crossplane-tools v0.0.0-20230925130601-628280f8bf79
-	github.com/crossplane/upjet v0.11.0-rc.0.0.20231012093706-c4a76d2a7505
+	github.com/crossplane/upjet v1.1.0-rc.0.0.20231213075930-cf1b3462e748
+	github.com/hashicorp/terraform-json v0.14.0
 	github.com/hashicorp/terraform-plugin-sdk/v2 v2.24.0
+	github.com/hashicorp/terraform-provider-google v1.20.1-0.20230807163356-c1a5133299b4
 	github.com/pkg/errors v0.9.1
 	gopkg.in/alecthomas/kingpin.v2 v2.2.6
 	k8s.io/apimachinery v0.28.4
@@ -16,105 +19,150 @@ require (
 )
 
 require (
-	dario.cat/mergo v1.0.0 // indirect
+	bitbucket.org/creachadair/stringset v0.0.8 // indirect
+	cloud.google.com/go v0.110.10 // indirect
+	cloud.google.com/go/bigtable v1.19.0 // indirect
+	cloud.google.com/go/compute v1.23.3 // indirect
+	cloud.google.com/go/compute/metadata v0.2.3 // indirect
+	cloud.google.com/go/iam v1.1.5 // indirect
+	cloud.google.com/go/longrunning v0.5.4 // indirect
+	github.com/GoogleCloudPlatform/declarative-resource-client-library v1.44.0 // indirect
 	github.com/agext/levenshtein v1.2.3 // indirect
 	github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 // indirect
 	github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 // indirect
 	github.com/antchfx/htmlquery v1.2.4 // indirect
 	github.com/antchfx/xpath v1.2.0 // indirect
+	github.com/apparentlymart/go-cidr v1.1.0 // indirect
 	github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cenkalti/backoff v2.2.1+incompatible // indirect
+	github.com/census-instrumentation/opencensus-proto v0.4.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/cncf/udpa/go v0.0.0-20220112060539-c52dc94e7fbe // indirect
+	github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4 // indirect
 	github.com/dave/jennifer v1.4.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
+	github.com/envoyproxy/go-control-plane v0.11.1 // indirect
+	github.com/envoyproxy/protoc-gen-validate v1.0.2 // indirect
+	github.com/evanphx/json-patch v5.6.0+incompatible // indirect
 	github.com/evanphx/json-patch/v5 v5.6.0 // indirect
 	github.com/fatih/camelcase v1.0.0 // indirect
 	github.com/fatih/color v1.15.0 // indirect
 	github.com/fsnotify/fsnotify v1.6.0 // indirect
-	github.com/go-logr/logr v1.2.4 // indirect
+	github.com/gammazero/deque v0.0.0-20180920172122-f6adf94963e4 // indirect
+	github.com/gammazero/workerpool v0.0.0-20181230203049-86a96b5d5d92 // indirect
+	github.com/go-logr/logr v1.3.0 // indirect
 	github.com/go-logr/zapr v1.2.4 // indirect
 	github.com/go-openapi/jsonpointer v0.19.6 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
 	github.com/go-openapi/swag v0.22.3 // indirect
 	github.com/gobuffalo/flect v1.0.2 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/glog v1.1.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/mock v1.6.0 // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/google/gnostic-models v0.6.8 // indirect
 	github.com/google/go-cmp v0.6.0 // indirect
+	github.com/google/go-cpy v0.0.0-20211218193943-a9c933c06932 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/google/uuid v1.3.1 // indirect
+	github.com/google/s2a-go v0.1.7 // indirect
+	github.com/google/uuid v1.4.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
+	github.com/googleapis/gax-go/v2 v2.12.0 // indirect
+	github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-checkpoint v0.5.0 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320 // indirect
 	github.com/hashicorp/go-hclog v1.2.1 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/hashicorp/go-plugin v1.4.8 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/go-version v1.6.0 // indirect
+	github.com/hashicorp/hc-install v0.4.0 // indirect
 	github.com/hashicorp/hcl/v2 v2.14.1 // indirect
 	github.com/hashicorp/logutils v1.0.0 // indirect
-	github.com/hashicorp/terraform-json v0.14.0 // indirect
-	github.com/hashicorp/terraform-plugin-go v0.14.0 // indirect
+	github.com/hashicorp/terraform-exec v0.17.3 // indirect
+	github.com/hashicorp/terraform-plugin-framework v1.1.1 // indirect
+	github.com/hashicorp/terraform-plugin-framework-validators v0.9.0 // indirect
+	github.com/hashicorp/terraform-plugin-go v0.14.3 // indirect
 	github.com/hashicorp/terraform-plugin-log v0.7.0 // indirect
+	github.com/hashicorp/terraform-registry-address v0.1.0 // indirect
+	github.com/hashicorp/terraform-svchost v0.0.0-20200729002733-f050f53b9734 // indirect
+	github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d // indirect
 	github.com/iancoleman/strcase v0.2.0 // indirect
 	github.com/imdario/mergo v0.3.16 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.17 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/go-ps v1.0.0 // indirect
 	github.com/mitchellh/go-testing-interface v1.14.1 // indirect
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
+	github.com/mitchellh/hashstructure v1.1.0 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/muvaf/typewriter v0.0.0-20210910160850-80e49fe1eb32 // indirect
+	github.com/oklog/run v1.0.0 // indirect
 	github.com/prometheus/client_golang v1.16.0 // indirect
 	github.com/prometheus/client_model v0.4.0 // indirect
 	github.com/prometheus/common v0.44.0 // indirect
 	github.com/prometheus/procfs v0.10.1 // indirect
-	github.com/spf13/afero v1.10.0 // indirect
-	github.com/spf13/cobra v1.7.0 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/spf13/afero v1.11.0 // indirect
+	github.com/spf13/cobra v1.8.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/tmccombs/hcl2json v0.3.3 // indirect
 	github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
 	github.com/vmihailenco/msgpack/v4 v4.3.12 // indirect
-	github.com/vmihailenco/tagparser v0.1.1 // indirect
+	github.com/vmihailenco/tagparser v0.1.2 // indirect
 	github.com/yuin/goldmark v1.4.13 // indirect
 	github.com/zclconf/go-cty v1.11.0 // indirect
+	github.com/zclconf/go-cty-yaml v1.0.3 // indirect
+	go.opencensus.io v0.24.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.26.0 // indirect
-	golang.org/x/exp v0.0.0-20231006140011-7918f672742d // indirect
-	golang.org/x/mod v0.13.0 // indirect
-	golang.org/x/net v0.17.0 // indirect
-	golang.org/x/oauth2 v0.11.0 // indirect
-	golang.org/x/sys v0.13.0 // indirect
-	golang.org/x/term v0.13.0 // indirect
-	golang.org/x/text v0.13.0 // indirect
-	golang.org/x/time v0.3.0 // indirect
-	golang.org/x/tools v0.14.0 // indirect
+	golang.org/x/crypto v0.16.0 // indirect
+	golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa // indirect
+	golang.org/x/mod v0.14.0 // indirect
+	golang.org/x/net v0.19.0 // indirect
+	golang.org/x/oauth2 v0.15.0 // indirect
+	golang.org/x/sync v0.5.0 // indirect
+	golang.org/x/sys v0.15.0 // indirect
+	golang.org/x/term v0.15.0 // indirect
+	golang.org/x/text v0.14.0 // indirect
+	golang.org/x/time v0.5.0 // indirect
+	golang.org/x/tools v0.15.0 // indirect
+	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
+	google.golang.org/api v0.152.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d // indirect
+	google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20231106174013-bbf56f31fb17 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20231120223509-83a465c0220f // indirect
 	google.golang.org/grpc v1.59.0 // indirect
-	google.golang.org/protobuf v1.31.0 // indirect
+	google.golang.org/protobuf v1.31.1-0.20231128094519-2087447a6b4a // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/api v0.28.4 // indirect
-	k8s.io/apiextensions-apiserver v0.28.3 // indirect
-	k8s.io/component-base v0.28.3 // indirect
+	k8s.io/apiextensions-apiserver v0.28.4 // indirect
+	k8s.io/component-base v0.28.4 // indirect
 	k8s.io/klog/v2 v2.100.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 // indirect
 	k8s.io/utils v0.0.0-20230726121419-3b25d923346b // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
-	sigs.k8s.io/yaml v1.3.0 // indirect
+	sigs.k8s.io/yaml v1.4.0 // indirect
 )
diff --git a/go.sum b/go.sum
index d87618e46..1757e538a 100644
--- a/go.sum
+++ b/go.sum
@@ -1,45 +1,32 @@
+bitbucket.org/creachadair/stringset v0.0.8 h1:gQqe4vs8XWgMyijfyKE6K8o4TcyGGrRXe0JvHgx5H+M=
+bitbucket.org/creachadair/stringset v0.0.8/go.mod h1:AgthVMyMxC/6FK1KBJ2ALdqkZObGN8hOetgpwXyMn34=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
-cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU=
-cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
-cloud.google.com/go v0.44.3/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
-cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc=
-cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0=
-cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To=
-cloud.google.com/go v0.52.0/go.mod h1:pXajvRH/6o3+F9jDHZWQ5PbGhn+o8w9qiu/CffaVdO4=
-cloud.google.com/go v0.53.0/go.mod h1:fp/UouUEsRkN6ryDKNW/Upv/JBKnv6WDthjR6+vze6M=
-cloud.google.com/go v0.54.0/go.mod h1:1rq2OEkV3YMf6n/9ZvGWI3GWw0VoqH/1x2nd8Is/bPc=
-cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKVk=
-cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
-cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
-cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
-cloud.google.com/go v0.72.0/go.mod h1:M+5Vjvlc2wnp6tjzE102Dw08nGShTscUx2nZMufOKPI=
-cloud.google.com/go v0.74.0/go.mod h1:VV1xSbzvo+9QJOxLDaJfTjx5e+MePCpCWwvftOeQmWk=
-cloud.google.com/go v0.75.0/go.mod h1:VGuuCn7PG0dwsd5XPVm2Mm3wlh3EL55/79EKB6hlPTY=
-cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
-cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
-cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
-cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
-cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
-cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
-cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
-cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
-cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
-cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
-cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
-cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
-cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
-cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
-cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
-cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
-cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
-cloud.google.com/go/storage v1.14.0/go.mod h1:GrKmX003DSIwi9o29oFT7YDnHYwZoctc3fOKtUw0Xmo=
+cloud.google.com/go v0.110.10 h1:LXy9GEO+timppncPIAZoOj3l58LIU9k+kn48AN7IO3Y=
+cloud.google.com/go v0.110.10/go.mod h1:v1OoFqYxiBkUrruItNM3eT4lLByNjxmJSV/xDKJNnic=
+cloud.google.com/go/bigtable v1.19.0 h1:wiq9LT0kukfInzvy1joMDijCw/OD1UChpSbORXYn0LI=
+cloud.google.com/go/bigtable v1.19.0/go.mod h1:xl5kPa8PTkJjdBxg6qdGH88464nNqmbISHSRU+D2yFE=
+cloud.google.com/go/compute v1.23.3 h1:6sVlXXBmbd7jNX0Ipq0trII3e4n1/MsADLK6a+aiVlk=
+cloud.google.com/go/compute v1.23.3/go.mod h1:VCgBUoMnIVIR0CscqQiPJLAG25E3ZRZMzcFZeQ+h8CI=
+cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
+cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
+cloud.google.com/go/iam v1.1.5 h1:1jTsCu4bcsNsE4iiqNT5SHwrDRCfRmIaaaVFhRveTJI=
+cloud.google.com/go/iam v1.1.5/go.mod h1:rB6P/Ic3mykPbFio+vo7403drjlgvoWfYpJhMXEbzv8=
+cloud.google.com/go/longrunning v0.5.4 h1:w8xEcbZodnA2BbW6sVirkkoC+1gP8wS57EUUgGS0GVg=
+cloud.google.com/go/longrunning v0.5.4/go.mod h1:zqNVncI0BOP8ST6XQD1+VcvuShMmq7+xFSzOL++V0dI=
 dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
 dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
-dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
+github.com/GoogleCloudPlatform/declarative-resource-client-library v1.44.0 h1:hASUAck0/5j84kejIHGJjipjUzFHiN5edNMobKwj2HA=
+github.com/GoogleCloudPlatform/declarative-resource-client-library v1.44.0/go.mod h1:pL2Qt5HT+x6xrTd806oMiM3awW6kNIXB/iiuClz6m6k=
+github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
+github.com/Microsoft/go-winio v0.4.16/go.mod h1:XB6nPKklQyQ7GC9LdcBEcBl8PF76WugXOPRXwdLnMv0=
+github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
+github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
+github.com/ProtonMail/go-crypto v0.0.0-20210428141323-04723f9f07d7 h1:YoJbenK9C67SkzkDfmQuVln04ygHj3vjZfd9FL+GmQQ=
+github.com/ProtonMail/go-crypto v0.0.0-20210428141323-04723f9f07d7/go.mod h1:z4/9nQmJSSwwds7ejkxaJwO37dru3geImFUdJlaLzQo=
+github.com/acomagu/bufpipe v1.0.3 h1:fxAGrHZTgQ9w5QqVItgzwj235/uYZYgbXitB+dLupOk=
+github.com/acomagu/bufpipe v1.0.3/go.mod h1:mxdxdup/WdsKVreO5GpW4+M/1CE2sMG4jeGJ2sYmHc4=
 github.com/agext/levenshtein v1.2.1/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
 github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7lmo=
 github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
@@ -48,51 +35,68 @@ github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 h1:JYp7IbQjafo
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 h1:s6gZFSlWYmbqAuRjVTiNNhvNRfY2Wxp9nhfyel4rklc=
 github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137/go.mod h1:OMCwj8VM1Kc9e19TLln2VL61YJF0x1XFtfdL4JdbSyE=
+github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239/go.mod h1:2FmKhYUyUczH0OGQWaF5ceTx0UBShxjsH6f8oGKYe2c=
 github.com/antchfx/htmlquery v1.2.4 h1:qLteofCMe/KGovBI6SQgmou2QNyedFUW+pE+BpeZ494=
 github.com/antchfx/htmlquery v1.2.4/go.mod h1:2xO6iu3EVWs7R2JYqBbp8YzG50gj/ofqs5/0VZoDZLc=
 github.com/antchfx/xpath v1.2.0 h1:mbwv7co+x0RwgeGAOHdrKy89GvHaGvxxBtPK0uF9Zr8=
 github.com/antchfx/xpath v1.2.0/go.mod h1:i54GszH55fYfBmoZXapTHN8T8tkcHfRgLyVwwqzXNcs=
+github.com/apparentlymart/go-cidr v1.1.0 h1:2mAhrMoF+nhXqxTzSZMUzDHkLjmIHC+Zzn4tdgBZjnU=
+github.com/apparentlymart/go-cidr v1.1.0/go.mod h1:EBcsNrHc3zQeuaeCeCtQruQm+n9/YjEn/vI25Lg7Gwc=
 github.com/apparentlymart/go-dump v0.0.0-20180507223929-23540a00eaa3/go.mod h1:oL81AME2rN47vu18xqj1S1jPIPuN7afo62yKTNn3XMM=
 github.com/apparentlymart/go-dump v0.0.0-20190214190832-042adf3cf4a0 h1:MzVXffFUye+ZcSR6opIgz9Co7WcDx6ZcY+RjfFHoA0I=
+github.com/apparentlymart/go-dump v0.0.0-20190214190832-042adf3cf4a0/go.mod h1:oL81AME2rN47vu18xqj1S1jPIPuN7afo62yKTNn3XMM=
 github.com/apparentlymart/go-textseg v1.0.0/go.mod h1:z96Txxhf3xSFMPmb5X/1W05FF/Nj9VFpLOpjS5yuumk=
 github.com/apparentlymart/go-textseg/v12 v12.0.0/go.mod h1:S/4uRK2UtaQttw1GenVJEynmyUenKwP++x/+DdGV/Ec=
 github.com/apparentlymart/go-textseg/v13 v13.0.0 h1:Y+KvPE1NYz0xl601PVImeQfFyEy6iT90AvPUL1NNfNw=
 github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkEghdlcqw7yxLeM89kiTRPUo=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/cenkalti/backoff v2.2.1+incompatible h1:tNowT99t7UNflLxfYYSlKYsBpXdEet03Pg2g16Swow4=
+github.com/cenkalti/backoff v2.2.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
+github.com/census-instrumentation/opencensus-proto v0.4.1 h1:iKLQ0xPNFxR/2hzXZMrBo8f1j86j5WHzznCCQxV/b8g=
+github.com/census-instrumentation/opencensus-proto v0.4.1/go.mod h1:4T9NM4+4Vw91VeyqjLS6ao50K5bOcLKN6Q42XnYaRYw=
 github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
 github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
-github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
-github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cncf/udpa/go v0.0.0-20220112060539-c52dc94e7fbe h1:QQ3GSy+MqSHxm/d8nCtnAiZdYFd45cYZPs8vOOIYKfk=
+github.com/cncf/udpa/go v0.0.0-20220112060539-c52dc94e7fbe/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
+github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4 h1:/inchEIKaYC1Akx+H+gqO04wryn5h75LSazbRlnya1k=
+github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/creachadair/staticfile v0.1.2/go.mod h1:a3qySzCIXEprDGxk6tSxSI+dBBdLzqeBOMhZ+o2d3pM=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/crossplane/crossplane-runtime v1.14.1 h1:TCa7R1N4bDGHjsLhiRxR/mUhwmistlMACHm0kiiYKck=
-github.com/crossplane/crossplane-runtime v1.14.1/go.mod h1:aOP+5W2wKpvthVs3pFNbVOe1jwrKYbJho0ThGNCVz9o=
+github.com/crossplane/crossplane-runtime v1.15.0-rc.0.0.20231213071410-0b379538ab14 h1:PrldAMuJ8Fm/YON/f0ztdCEwT3S9zOnZUbRoOSL4Yz0=
+github.com/crossplane/crossplane-runtime v1.15.0-rc.0.0.20231213071410-0b379538ab14/go.mod h1:pgt7PaTvvOQz3jILyxbCaeleU9MrAqKaNoPJavhGBgM=
 github.com/crossplane/crossplane-tools v0.0.0-20230925130601-628280f8bf79 h1:HigXs5tEQxWz0fcj8hzbU2UAZgEM7wPe0XRFOsrtF8Y=
 github.com/crossplane/crossplane-tools v0.0.0-20230925130601-628280f8bf79/go.mod h1:+e4OaFlOcmr0JvINHl/yvEYBrZawzTgj6pQumOH1SS0=
-github.com/crossplane/upjet v0.11.0-rc.0.0.20231012093706-c4a76d2a7505 h1:eCmYgfRopVn6r8RM1Ra4XQAPwVsjTGfktBj2Dk7yy+Y=
-github.com/crossplane/upjet v0.11.0-rc.0.0.20231012093706-c4a76d2a7505/go.mod h1:Ov+eoYS2n0Zge/E50zm65meOTYbAHnU6jPt27fQrpbc=
+github.com/crossplane/upjet v1.1.0-rc.0.0.20231213075930-cf1b3462e748 h1:lz9T1ODwXYzeFg5EEeW8PbOM6/bBcwWeE0ryCSykTSw=
+github.com/crossplane/upjet v1.1.0-rc.0.0.20231213075930-cf1b3462e748/go.mod h1:t9etxIdYaxgyvFPBToikm5zBHi8RIpX8N4mTH77lQFM=
 github.com/dave/jennifer v1.4.1 h1:XyqG6cn5RQsTj3qlWQTKlRGAyrTcsk1kUmWdZBzRjDw=
 github.com/dave/jennifer v1.4.1/go.mod h1:7jEdnm+qBcxl8PC0zyp7vxcpSRnzXSt9r39tpTVGlwA=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dnaeon/go-vcr v1.0.1 h1:r8L/HqC0Hje5AXMu1ooW8oyQyOFv4GxqpL0nRP7SLLY=
+github.com/dnaeon/go-vcr v1.0.1/go.mod h1:aBB1+wY4s93YsC3HHjMBMrwTj2R9FHDzUr9KyGc8n1E=
 github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
 github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/emirpasic/gods v1.12.0 h1:QAUIPSaCu4G+POclxeqb3F+WPpdKqFGlw36+yOzGlrg=
+github.com/emirpasic/gods v1.12.0/go.mod h1:YfzfFFoVP/catgzJb4IKIqXjX78Ha8FMSDh3ymbK86o=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5ynNVH9qI8YYLbd1fK2po=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
+github.com/envoyproxy/go-control-plane v0.11.1 h1:wSUXTlLfiAQRWs2F+p+EKOY9rUyis1MyGqJ2DIk5HpM=
+github.com/envoyproxy/go-control-plane v0.11.1/go.mod h1:uhMcXKCQMEJHiAb0w+YGefQLaTEw+YhGluxZkrTmD0g=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/envoyproxy/protoc-gen-validate v1.0.2 h1:QkIBuU5k+x7/QXPvPPnWXWlCdaBFApVqftFV6k087DA=
+github.com/envoyproxy/protoc-gen-validate v1.0.2/go.mod h1:GpiZQP3dDbg4JouG/NNS7QWXpgx6x8QiMKdmN72jogE=
 github.com/evanphx/json-patch v5.6.0+incompatible h1:jBYDEEiFBPxA0v50tFdvOzQQTCvpL6mnFh5mB2/l16U=
+github.com/evanphx/json-patch v5.6.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/evanphx/json-patch/v5 v5.6.0 h1:b91NhWfaz02IuVxO9faSllyAtNXHMPkC5J8sJCLunww=
 github.com/evanphx/json-patch/v5 v5.6.0/go.mod h1:G79N1coSVB93tBe7j6PhzjmR3/2VvlbKOFpnXhI9Bw4=
 github.com/fatih/camelcase v1.0.0 h1:hxNvNX/xYBp0ovncs8WyWZrOrpBNub/JfaMvbURyft8=
@@ -100,14 +104,28 @@ github.com/fatih/camelcase v1.0.0/go.mod h1:yN2Sb0lFhZJUdVvtELVWefmrXpuZESvPmqwo
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
 github.com/fatih/color v1.15.0 h1:kOqh6YHBtK8aywxGerMG2Eq3H6Qgoqeo13Bk2Mv/nBs=
 github.com/fatih/color v1.15.0/go.mod h1:0h5ZqXfHYED7Bhv2ZJamyIOUej9KtShiJESRwBDUSsw=
+github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
 github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
 github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
-github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
+github.com/gammazero/deque v0.0.0-20180920172122-f6adf94963e4 h1:R+19WKQClnfMXS60cP5BmMe1wjZ4u0evY2p2Ar0ZTXo=
+github.com/gammazero/deque v0.0.0-20180920172122-f6adf94963e4/go.mod h1:GeIq9qoE43YdGnDXURnmKTnGg15pQz4mYkXSTChbneI=
+github.com/gammazero/workerpool v0.0.0-20181230203049-86a96b5d5d92 h1:EipXK6U05IQ2wtuFRn4k3h0+2lXypzItoXGVyf4r9Io=
+github.com/gammazero/workerpool v0.0.0-20181230203049-86a96b5d5d92/go.mod h1:w9RqFVO2BM3xwWEcAB8Fwp0OviTBBEiRmSBDfbXnd3w=
+github.com/gliderlabs/ssh v0.2.2/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
+github.com/go-git/gcfg v1.5.0 h1:Q5ViNfGF8zFgyJWPqYwA7qGFoMTEiBmdlkcfRmpIMa4=
+github.com/go-git/gcfg v1.5.0/go.mod h1:5m20vg6GwYabIxaOonVkTdrILxQMpEShl1xiMF4ua+E=
+github.com/go-git/go-billy/v5 v5.2.0/go.mod h1:pmpqyWchKfYfrkb/UVH4otLvyi/5gJlGI4Hb3ZqZ3W0=
+github.com/go-git/go-billy/v5 v5.3.1 h1:CPiOUAzKtMRvolEKw+bG1PLRpT7D3LIs3/3ey4Aiu34=
+github.com/go-git/go-billy/v5 v5.3.1/go.mod h1:pmpqyWchKfYfrkb/UVH4otLvyi/5gJlGI4Hb3ZqZ3W0=
+github.com/go-git/go-git-fixtures/v4 v4.2.1/go.mod h1:K8zd3kDUAykwTdDCr+I0per6Y6vMiRR/nnVTBtavnB0=
+github.com/go-git/go-git/v5 v5.4.2 h1:BXyZu9t0VkbiHtqrsvdq39UDhGJTl1h55VW6CSC4aY4=
+github.com/go-git/go-git/v5 v5.4.2/go.mod h1:gQ1kArt6d+n+BGd+/B/I74HwRTLhth2+zti4ihgckDc=
+github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
 github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.3.0 h1:2y3SDp0ZXuc6/cjLSZ+Q3ir+QB9T/iG5yYRXqsagWSY=
+github.com/go-logr/logr v1.3.0/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/zapr v1.2.4 h1:QHVo+6stLbfJmYGkQ7uGHUCu5hnAFAj6mDe6Ea0SeOo=
 github.com/go-logr/zapr v1.2.4/go.mod h1:FyHWQIzQORZ0QVE1BtVHv3cKtNLuXsbNLtpuhNapBOA=
 github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
@@ -116,7 +134,9 @@ github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2Kv
 github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
 github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/g=
 github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
+github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
+github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
 github.com/go-test/deep v1.0.3/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
 github.com/go-test/deep v1.0.7 h1:/VSMRlnY/JSyqxQUzQLKVMAskpY/NZKFA5j2P+0pP2M=
 github.com/go-test/deep v1.0.7/go.mod h1:QV8Hv/iy04NyLBxAdO9njL0iVPN1S4d/A3NVv1V36o8=
@@ -125,18 +145,12 @@ github.com/gobuffalo/flect v1.0.2/go.mod h1:A5msMlrHtLqh9umBSnvabjsMrCcCpAyzglnD
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/glog v1.1.2 h1:DVjP2PbBOzHyzA+dn3WhHIq4NdVu3Q+pvivFICf/7fo=
+github.com/golang/glog v1.1.2/go.mod h1:zR+okUeTbrL6EL3xHUDxZuEtGv04p5shwip1+mL/rLQ=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
-github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
 github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc=
 github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
 github.com/golang/protobuf v1.1.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
@@ -145,110 +159,133 @@ github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5y
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
 github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
 github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
 github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
 github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
 github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
 github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
 github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
 github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/google/addlicense v0.0.0-20210428195630-6d92264d7170/go.mod h1:EMjYTRimagHs1FwlIqKyX3wAM0u3rA+McvlIIWmSamA=
-github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/btree v1.1.2 h1:xf4v41cLI2Z6FxbKm+8Bu+m8ifhj15JuZ9sa0jZCMUU=
+github.com/google/btree v1.1.2/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
 github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
 github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cpy v0.0.0-20211218193943-a9c933c06932 h1:5/4TSDzpDnHQ8rKEEQBjRlYx77mHOvXu08oGchxej7o=
+github.com/google/go-cpy v0.0.0-20211218193943-a9c933c06932/go.mod h1:cC6EdPbj/17GFCPDK39NRarlMI+kt+O60S12cNB5J9Y=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
-github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
-github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
-github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20201023163331-3e6fc7fc9c4c/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20201218002935-b9804c9f04c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20230926050212-f7f687d19a98 h1:pUa4ghanp6q4IJHwE9RwLgmVFfReJN+KbQ8ExNEUUoQ=
-github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
+github.com/google/pprof v0.0.0-20231101202521-4ca4178f5c7a h1:fEBsGL/sjAuJrgah5XqmmYsTLzJp/TO9Lhy39gkverk=
+github.com/google/pprof v0.0.0-20231101202521-4ca4178f5c7a/go.mod h1:czg5+yv1E0ZGTi6S6vVK1mke0fV+FaUhNGcd6VRS9Ik=
+github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o=
+github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.1 h1:KjJaJ9iWZ3jOFZIf1Lqf4laDRCasjl0BCmnEGxkdLb4=
-github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
-github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
+github.com/google/uuid v1.4.0 h1:MtMxsa51/r9yyhkyLsVeVt0B+BGQZzpQiTQ4eHZ8bc4=
+github.com/google/uuid v1.4.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/enterprise-certificate-proxy v0.3.2 h1:Vie5ybvEvT75RniqhfFxPRy3Bf7vr3h0cechB90XaQs=
+github.com/googleapis/enterprise-certificate-proxy v0.3.2/go.mod h1:VLSiSSBs/ksPL8kq3OBOQ6WRI2QnaFynd1DCjZ62+V0=
+github.com/googleapis/gax-go/v2 v2.12.0 h1:A+gCJKdRfqXkr+BIRGtZLibNXf0m1f9E4HG56etFpas=
+github.com/googleapis/gax-go/v2 v2.12.0/go.mod h1:y+aIqrI5eb1YGMVJfuV3185Ts/D7qKpsEkdD5+I6QGU=
+github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 h1:+9834+KizmvFV7pXQGSXQTsaWhq2GjuNUt0aUU0YBYw=
+github.com/grpc-ecosystem/go-grpc-middleware v1.3.0/go.mod h1:z0ButlSOZa5vEBq9m2m2hlwIgKw+rp3sdCBRoJY+30Y=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-checkpoint v0.5.0 h1:MFYpPZCnQqQTE18jFwSII6eUQrD/oxMFp3mlgcqk5mU=
+github.com/hashicorp/go-checkpoint v0.5.0/go.mod h1:7nfLNL10NsxqO4iWuW6tWW0HjZuDrwkBuEQsVcpCOgg=
+github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
+github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
+github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
+github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
 github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320 h1:1/D3zfFHttUKaCaGKZ/dR2roBXv0vKbSCnssIldfQdI=
 github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320/go.mod h1:EiZBMaudVLy8fmjf9Npq1dq9RalhveqZG5w/yz3mHWs=
 github.com/hashicorp/go-hclog v1.2.1 h1:YQsLlGDJgwhXFpucSPyVbCBviQtjlHv3jLTlp8YmtEw=
 github.com/hashicorp/go-hclog v1.2.1/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
+github.com/hashicorp/go-plugin v1.4.8 h1:CHGwpxYDOttQOY7HOWgETU9dyVjOXzniXDqJcYJE1zM=
+github.com/hashicorp/go-plugin v1.4.8/go.mod h1:viDMjcLJuDui6pXb8U4HVfb8AamCWhHGUjr2IrTF67s=
+github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-version v1.2.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/go-version v1.5.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/go-version v1.6.0 h1:feTTfFNnjP967rlCxM/I9g701jU+RN74YKx2mOkIeek=
 github.com/hashicorp/go-version v1.6.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
-github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/hc-install v0.4.0 h1:cZkRFr1WVa0Ty6x5fTvL1TuO1flul231rWkGH92oYYk=
+github.com/hashicorp/hc-install v0.4.0/go.mod h1:5d155H8EC5ewegao9A4PUTMNPZaq+TbOzkJJZ4vrXeI=
 github.com/hashicorp/hcl/v2 v2.9.1/go.mod h1:FwWsfWEjyV/CMj8s/gqAuiviY72rJ1/oayI9WftqcKg=
 github.com/hashicorp/hcl/v2 v2.14.1 h1:x0BpjfZ+CYdbiz+8yZTQ+gdLO7IXvOut7Da+XJayx34=
 github.com/hashicorp/hcl/v2 v2.14.1/go.mod h1:e4z5nxYlWNPdDSNYX+ph14EvWYMFm3eP0zIUqPc2jr0=
 github.com/hashicorp/logutils v1.0.0 h1:dLEQVugN8vlakKOUE3ihGLTZJRB4j+M2cdTm/ORI65Y=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
+github.com/hashicorp/terraform-exec v0.17.3 h1:MX14Kvnka/oWGmIkyuyvL6POx25ZmKrjlaclkx3eErU=
+github.com/hashicorp/terraform-exec v0.17.3/go.mod h1:+NELG0EqQekJzhvikkeQsOAZpsw0cv/03rbeQJqscAI=
 github.com/hashicorp/terraform-json v0.14.0 h1:sh9iZ1Y8IFJLx+xQiKHGud6/TSUCM0N8e17dKDpqV7s=
 github.com/hashicorp/terraform-json v0.14.0/go.mod h1:5A9HIWPkk4e5aeeXIBbkcOvaZbIYnAIkEyqP2pNSckM=
-github.com/hashicorp/terraform-plugin-go v0.14.0 h1:ttnSlS8bz3ZPYbMb84DpcPhY4F5DsQtcAS7cHo8uvP4=
-github.com/hashicorp/terraform-plugin-go v0.14.0/go.mod h1:2nNCBeRLaenyQEi78xrGrs9hMbulveqG/zDMQSvVJTE=
+github.com/hashicorp/terraform-plugin-framework v1.1.1 h1:PbnEKHsIU8KTTzoztHQGgjZUWx7Kk8uGtpGMMc1p+oI=
+github.com/hashicorp/terraform-plugin-framework v1.1.1/go.mod h1:DyZPxQA+4OKK5ELxFIIcqggcszqdWWUpTLPHAhS/tkY=
+github.com/hashicorp/terraform-plugin-framework-validators v0.9.0 h1:LYz4bXh3t7bTEydXOmPDPupRRnA480B/9+jV8yZvxBA=
+github.com/hashicorp/terraform-plugin-framework-validators v0.9.0/go.mod h1:+BVERsnfdlhYR2YkXMBtPnmn9UsL19U3qUtSZ+Y/5MY=
+github.com/hashicorp/terraform-plugin-go v0.14.3 h1:nlnJ1GXKdMwsC8g1Nh05tK2wsC3+3BL/DBBxFEki+j0=
+github.com/hashicorp/terraform-plugin-go v0.14.3/go.mod h1:7ees7DMZ263q8wQ6E4RdIdR6nHHJtrdt4ogX5lPkX1A=
 github.com/hashicorp/terraform-plugin-log v0.7.0 h1:SDxJUyT8TwN4l5b5/VkiTIaQgY6R+Y2BQ0sRZftGKQs=
 github.com/hashicorp/terraform-plugin-log v0.7.0/go.mod h1:p4R1jWBXRTvL4odmEkFfDdhUjHf9zcs/BCoNHAc7IK4=
+github.com/hashicorp/terraform-plugin-mux v0.8.0 h1:WCTP66mZ+iIaIrCNJnjPEYnVjawTshnDJu12BcXK1EI=
+github.com/hashicorp/terraform-plugin-mux v0.8.0/go.mod h1:vdW0daEi8Kd4RFJmet5Ot+SIVB/B8SwQVJiYKQwdCy8=
 github.com/hashicorp/terraform-plugin-sdk/v2 v2.24.0 h1:FtCLTiTcykdsURXPt/ku7fYXm3y19nbzbZcUxHx9RbI=
 github.com/hashicorp/terraform-plugin-sdk/v2 v2.24.0/go.mod h1:80wf5oad1tW+oLnbXS4UTYmDCrl7BuN1Q+IA91X1a4Y=
+github.com/hashicorp/terraform-provider-google v1.20.1-0.20230807163356-c1a5133299b4 h1:rJNfhKGcXD9dDN6ebiMStrtWZ5HzjaLz5MNt0NJ94lY=
+github.com/hashicorp/terraform-provider-google v1.20.1-0.20230807163356-c1a5133299b4/go.mod h1:l+xWrh5x5jUY9J1uQEU4ujOdsOTQl7H7hrLwzAWzYGA=
+github.com/hashicorp/terraform-registry-address v0.1.0 h1:W6JkV9wbum+m516rCl5/NjKxCyTVaaUBbzYcMzBDO3U=
+github.com/hashicorp/terraform-registry-address v0.1.0/go.mod h1:EnyO2jYO6j29DTHbJcm00E5nQTFeTtyZH3H5ycydQ5A=
+github.com/hashicorp/terraform-svchost v0.0.0-20200729002733-f050f53b9734 h1:HKLsbzeOsfXmKNpr3GiT18XAblV0BjCbzL8KQAMZGa0=
+github.com/hashicorp/terraform-svchost v0.0.0-20200729002733-f050f53b9734/go.mod h1:kNDNcF7sN4DocDLBkQYz73HGKwN1ANB1blq4lIYLYvg=
+github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d h1:kJCB4vdITiW1eC1vq2e6IsrXKrZit1bv/TDYFGMp4BQ=
+github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
 github.com/iancoleman/strcase v0.2.0 h1:05I4QRnGpI0m37iZQRuskXh+w77mr6Z41lwQzuHLwW0=
 github.com/iancoleman/strcase v0.2.0/go.mod h1:iwCmte+B7n89clKwxIoIXy/HfoL7AsD47ZCWhYzw7ho=
-github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
+github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
 github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4=
 github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
+github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
+github.com/jessevdk/go-flags v1.5.0/go.mod h1:Fw0T6WPc1dYxT4mKEZRfG5kJhaTDP9pj1c2EWnYs/m4=
+github.com/jhump/protoreflect v1.6.0 h1:h5jfMVslIg6l29nsMs0D8Wj17RDVdNYti0vDN/PZZoE=
+github.com/jhump/protoreflect v1.6.0/go.mod h1:eaTn3RZAmMBcV0fifFvlm6VHNz3wSkYyXYWUh7ymB74=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
-github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
+github.com/kevinburke/ssh_config v0.0.0-20201106050909-4977a11b4351 h1:DowS9hvgyYSX4TO5NpyC606/Z4SxnNYbT+WX27or6Ck=
+github.com/kevinburke/ssh_config v0.0.0-20201106050909-4977a11b4351/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -258,6 +295,7 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/matryer/is v1.2.0/go.mod h1:2fLPjFQM9rhQ15aVEtbuwhJinnOqrmgXPNdZsdwlWXA=
 github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
@@ -271,6 +309,8 @@ github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zk
 github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
+github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
+github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc=
 github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg=
 github.com/mitchellh/go-testing-interface v1.14.1 h1:jrgshOhYAUVNMAJiKbEu7EqAwgJJ2JqpQmpLJOu07cU=
@@ -278,6 +318,8 @@ github.com/mitchellh/go-testing-interface v1.14.1/go.mod h1:gfgS7OtZj6MA4U1UrDRp
 github.com/mitchellh/go-wordwrap v0.0.0-20150314170334-ad45545899c7/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
 github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
 github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
+github.com/mitchellh/hashstructure v1.1.0 h1:P6P1hdjqAAknpY/M1CGipelZgp+4y9ja9kmUZPXP+H0=
+github.com/mitchellh/hashstructure v1.1.0/go.mod h1:xUDAozZz0Wmdiufv0uyhnHkUTN6/6d8ulp4AwfLKrmA=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
@@ -291,15 +333,21 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/muvaf/typewriter v0.0.0-20210910160850-80e49fe1eb32 h1:yBQlHXLeUJL3TWVmzup5uT3wG5FLxhiTAiTsmNVocys=
 github.com/muvaf/typewriter v0.0.0-20210910160850-80e49fe1eb32/go.mod h1:SAAdeMEiFXR8LcHffvIdiLI1w243DCH2DuHq7UrA5YQ=
-github.com/nsf/jsondiff v0.0.0-20200515183724-f29ed568f4ce h1:RPclfga2SEJmgMmz2k+Mg7cowZ8yv4Trqw9UsJby758=
+github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
+github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
+github.com/oklog/run v1.0.0 h1:Ru7dDtJNOyC66gQ5dQmaCa0qIsAUFY3sFpK1Xk8igrw=
+github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA=
 github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
+github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
 github.com/onsi/ginkgo/v2 v2.11.0 h1:WgqUCUt/lT6yXoQ8Wef0fsNn5cAuMK7+KT9UFRz2tcU=
+github.com/onsi/ginkgo/v2 v2.11.0/go.mod h1:ZhrRA5XmEE3x3rhlzamx/JJvujdZoJ2uvgI7kR0iZvM=
 github.com/onsi/gomega v1.27.10 h1:naR28SdDFlqrG6kScpT8VWpu1xWY5nJRCF3XaYyBjhI=
+github.com/onsi/gomega v1.27.10/go.mod h1:RsS8tutOdbdgzbPtzzATp12yT7kM5I5aElG3evPbQ0M=
+github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/sftp v1.13.1/go.mod h1:3HaPG6Dq1ILlpPZRO0HVMrsydcdLt6HRDccSgb87qRg=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_golang v1.16.0 h1:yk/hx9hDbrGHovbci4BY+pRMfSuuat626eFsHb7tmT8=
@@ -311,31 +359,39 @@ github.com/prometheus/common v0.44.0 h1:+5BrQJwiBB9xsMygAB3TNvpQKOwlkc25LbISbrdO
 github.com/prometheus/common v0.44.0/go.mod h1:ofAIvZbQ1e/nugmZGz4/qCb9Ap1VoSTIO7x0VV9VvuY=
 github.com/prometheus/procfs v0.10.1 h1:kYK1Va/YMlutzCGazswoHKo//tZVlFpKYh+PymziUAg=
 github.com/prometheus/procfs v0.10.1/go.mod h1:nwNm2aOCAYw8uTR/9bWRREkZFxAUcWzPHWJq+XBB/FM=
-github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
+github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sebdah/goldie v1.0.0/go.mod h1:jXP4hmWywNEwZzhMuv2ccnqTSFpuq8iyQhtQdkkZBH4=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
-github.com/spf13/afero v1.10.0 h1:EaGW2JJh15aKOejeuJ+wpFSHnbd7GE6Wvp3TsNhb6LY=
-github.com/spf13/afero v1.10.0/go.mod h1:UBogFpq8E9Hx+xc5CNTTEpTnuHVmXDwZcZcE1eb/UhQ=
-github.com/spf13/cobra v1.7.0 h1:hyqWnYt1ZQShIddO5kBpj3vu05/++x6tJ6dg8EC572I=
-github.com/spf13/cobra v1.7.0/go.mod h1:uLxZILRyS/50WlhOIKD7W6V5bgeIt+4sICxh6uRMrb0=
+github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
+github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
+github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
+github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
+github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/spf13/afero v1.11.0 h1:WJQKhtpdm3v2IzqG8VMqrr6Rf3UYpEF239Jy9wNepM8=
+github.com/spf13/afero v1.11.0/go.mod h1:GH9Y3pIexgf1MTIWtNGyogA5MwRIDXGUr+hbWNoBjkY=
+github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
+github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
 github.com/spf13/pflag v1.0.2/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8=
+github.com/stretchr/testify v1.8.3 h1:RP3t2pwF7cMEbC1dqtB6poj3niw/9gnV4Cjg5oW5gtY=
+github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/tmccombs/hcl2json v0.3.3 h1:+DLNYqpWE0CsOQiEZu+OZm5ZBImake3wtITYxQ8uLFQ=
 github.com/tmccombs/hcl2json v0.3.3/go.mod h1:Y2chtz2x9bAeRTvSibVRVgbLJhLJXKlUeIvjeVdnm4w=
 github.com/vmihailenco/msgpack v3.3.3+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
@@ -343,15 +399,17 @@ github.com/vmihailenco/msgpack v4.0.4+incompatible h1:dSLoQfGFAo3F6OoNhwUmLwVgaU
 github.com/vmihailenco/msgpack v4.0.4+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
 github.com/vmihailenco/msgpack/v4 v4.3.12 h1:07s4sz9IReOgdikxLTKNbBdqDMLsjPKXwvCazn8G65U=
 github.com/vmihailenco/msgpack/v4 v4.3.12/go.mod h1:gborTTJjAo/GWTqqRjrLCn9pgNN+NXzzngzBKDPIqw4=
-github.com/vmihailenco/tagparser v0.1.1 h1:quXMXlA39OCbd2wAdTsGDlK9RkOk6Wuw+x37wVyIuWY=
 github.com/vmihailenco/tagparser v0.1.1/go.mod h1:OeAg3pn3UbLjkWt+rN9oFYB6u/cQgqMEUPoW2WPyhdI=
-github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/vmihailenco/tagparser v0.1.2 h1:gnjoVuB/kljJ5wICEEOpx98oXMWPLj22G67Vbd1qPqc=
+github.com/vmihailenco/tagparser v0.1.2/go.mod h1:OeAg3pn3UbLjkWt+rN9oFYB6u/cQgqMEUPoW2WPyhdI=
+github.com/xanzy/ssh-agent v0.3.0 h1:wUMzuKtKilRgBAD1sUb8gOwwRr2FGoBVumcjoOACClI=
+github.com/xanzy/ssh-agent v0.3.0/go.mod h1:3s9xbODqPuuhK9JV1R321M/FlMZSBvE5aY6eAcqrDh0=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13 h1:fVcFKWvrslecOb/tg+Cc05dkeYx540o0FuFt3nUVDoE=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/zclconf/go-cty v1.1.0/go.mod h1:xnAOWiHeOqg2nWS62VtQ7pbOu17FtxJNW8RLEih+O3s=
 github.com/zclconf/go-cty v1.2.0/go.mod h1:hOPWgoHbaTUnI5k4D2ld+GRpFJSCe6bCM7m1q/N4PQ8=
 github.com/zclconf/go-cty v1.8.0/go.mod h1:vVKLxnk3puL4qRAv72AO+W99LUD4da90g3uUAzyuvAk=
 github.com/zclconf/go-cty v1.8.1/go.mod h1:vVKLxnk3puL4qRAv72AO+W99LUD4da90g3uUAzyuvAk=
@@ -359,67 +417,45 @@ github.com/zclconf/go-cty v1.10.0/go.mod h1:vVKLxnk3puL4qRAv72AO+W99LUD4da90g3uU
 github.com/zclconf/go-cty v1.11.0 h1:726SxLdi2SDnjY+BStqB9J1hNp4+2WlzyXLuimibIe0=
 github.com/zclconf/go-cty v1.11.0/go.mod h1:s9IfD1LK5ccNMSWCVFCE2rJfHiZgi7JijgeWIMfhLvA=
 github.com/zclconf/go-cty-debug v0.0.0-20191215020915-b22d67c1ba0b/go.mod h1:ZRKQfBXbGkpdV6QMzT3rU1kSTAnfu1dO8dPKjYprgj8=
-go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
-go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
-go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
+github.com/zclconf/go-cty-yaml v1.0.3 h1:og/eOQ7lvA/WWhHGFETVWNduJM7Rjsv2RRpx1sdFMLc=
+github.com/zclconf/go-cty-yaml v1.0.3/go.mod h1:9YLUH4g7lOhVWqUbctnVlZ5KLpg7JAprQNgxSZ1Gyxs=
+go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
+go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
+go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/goleak v1.1.11/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
 go.uber.org/goleak v1.2.1 h1:NBol2c7O1ZokfZ0LEU9K6Whx/KnwvepVetCUhtKja4A=
+go.uber.org/goleak v1.2.1/go.mod h1:qlT2yGI9QafXHhZZLxlSuNsMw3FFLxBr+tBRlmO1xH4=
+go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
 go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
+go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
 go.uber.org/zap v1.24.0/go.mod h1:2kMP+WWQ8aoFoedH3T2sq6iJ2yDWpHbP0f6MQbS9Gkg=
 go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
 go.uber.org/zap v1.26.0/go.mod h1:dtElttAiwGvoJ/vj4IwHBS/gXsEu/pZ50mUIRWuG0so=
+golang.org/x/crypto v0.0.0-20190219172222-a4c6cb3142f2/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190426145343-a29dc8fdc734/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
-golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.16.0 h1:mMMrFzRSCF0GvB7Ne27XVtVAaXLrPmgPC7/v0tkwHaY=
+golang.org/x/crypto v0.16.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
-golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek=
-golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY=
-golang.org/x/exp v0.0.0-20191129062945-2f5052295587/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
-golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM8rJBtfilJ2qTU199MI=
-golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo=
-golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
-golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
+golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa h1:FRnLl4eNAQl8hwxVVC17teOw8kdjVDVAiFMtgUdTSRQ=
+golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa/go.mod h1:zk2irFbV9DP96SEBUUAy67IdHUaZuSnrz1n472HUCLE=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
-golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
-golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
-golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
-golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
-golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.13.0 h1:I/DsJXRlw/8l/0c24sM9yb0T4z9liZTduXvdAWYiysY=
-golang.org/x/mod v0.13.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
+golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180811021610-c39426892332/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -427,264 +463,117 @@ golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73r
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200222125558-5a598a2470a0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20191009170851-d66e71096ffb/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200421231249-e086a090c8fd/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20210326060303-6b1517762897/go.mod h1:uSPa2vr4CLtc/ILN5odXGNXS6mhrKVzTaCXzk9m6W3k=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
-golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
-golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
+golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
+golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.11.0 h1:vPL4xzxBM4niKCW6g9whtaWVXTJf1U5e4aZxxFx/gbU=
-golang.org/x/oauth2 v0.11.0/go.mod h1:LdF7O/8bLR/qWK9DrpXmbHLTouvRHK0SgJl0GmDBchk=
+golang.org/x/oauth2 v0.15.0 h1:s8pnnxNVzjWyrvYdFUQq5llS1PX2zhPXmccZv99h7uQ=
+golang.org/x/oauth2 v0.15.0/go.mod h1:q48ptWNTY5XWf+JNten23lcvHpLJ0ZSxF5ttTHKVCAM=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.4.0 h1:zxkM55ReGkDlKSM+Fu41A+zmbZuaPVbGMzvvdUPznYQ=
+golang.org/x/sync v0.5.0 h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=
+golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190502175342-a43fa875dd82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210225134936-a50acf3fe073/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210324051608-47abb6519492/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423185535-09eb48e85fd7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210502180810-71e4cd670f79/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
-golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
+golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek=
-golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
-golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/term v0.15.0 h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4=
+golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
-golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
+golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191216173652-a0e659d51361/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200122220014-bf1340f18c4a/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200204074204-1cc6d1ef6c74/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200207183749-b753a1ba74fa/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200212150539-ea181f53ac56/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200224181240-023911ca70b2/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200227222343-706bc42d1f0d/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
-golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200904185747-39188db58858/go.mod h1:Cj7w3i3Rnn0Xh82ur9kSqwfTHTeVxaDqrfMjpcNT6bE=
-golang.org/x/tools v0.0.0-20201110124207-079ba7bd75cd/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201201161351-ac6f37ff4c2a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201208233053-a543418bbed2/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20210108195828-e2f9c7f1fc8e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
 golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.14.0 h1:jvNa2pY0M4r62jkRQ6RwEZZyPcymeL9XZMLBbV7U2nc=
-golang.org/x/tools v0.14.0/go.mod h1:uYBEerGOWcJyEORxN+Ek8+TT266gXkNlHdJBwexUsBg=
+golang.org/x/tools v0.15.0 h1:zdAyfUGbYmuVokhzVmghFl2ZJh5QhcfebBgmVPFYA+8=
+golang.org/x/tools v0.15.0/go.mod h1:hpksKq4dtpQWS1uQ61JkdqWM3LscIS6Slf+VVkm+wQk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 h1:H2TDz8ibqkAF6YGhCdN3jS9O0/s90v0rJh3X/OLHEUk=
+golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
 gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw=
 gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
-google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
-google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
-google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.9.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.13.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.14.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.15.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.17.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.18.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.19.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.20.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.22.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
-google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
-google.golang.org/api v0.35.0/go.mod h1:/XrVsuzM0rZmrsbjJutiuftIzeuTQcEeaYcSk/mQ1dg=
-google.golang.org/api v0.36.0/go.mod h1:+z5ficQTmoYpPn8LCUNVpK5I7hwkpjbcgqA7I34qYtE=
-google.golang.org/api v0.40.0/go.mod h1:fYKFpnQN0DsDSKRVRcQSDQNtqWPfM9i+zNPxepjRCQ8=
+google.golang.org/api v0.152.0 h1:t0r1vPnfMc260S2Ci+en7kfCZaLOPs5KI0sVV/6jZrY=
+google.golang.org/api v0.152.0/go.mod h1:3qNJX5eOmhiWYc67jRA/3GsDw97UFb5ivv7Y2PrriAY=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
 google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
-google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191115194625-c23dd37a84c9/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191216164720-4f79533eabd1/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200115191322-ca5a22157cba/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200122232147-0452cf42e150/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200204135345-fa8e72b47b90/go.mod h1:GmwEX6Z4W5gMy59cAlVYjN9JhxgbQH6Gn+gFDQe2lzA=
-google.golang.org/genproto v0.0.0-20200212174721-66ed5ce911ce/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200224152610-e50cd9704f63/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200228133532-8c2c7df3a383/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200305110556-506484158171/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U=
+google.golang.org/genproto v0.0.0-20200423170343-7949de9c1215/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
-google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201109203340-2640f1f9cdfb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201201144952-b05cb90ed32e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210108203827-ffc7fda8c3d7/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210226172003-ab064af71705/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d h1:uvYuEyMHKNt+lT4K3bN6fGswmK8qSvcreM3BwjDh+y4=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d/go.mod h1:+Bk1OCOj40wS2hwAMA+aCW9ypzm63QTBBHp6lQ3p+9M=
+google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17 h1:wpZ8pe2x1Q3f2KyT5f8oP/fa9rHAKgFPr/HZdNuS+PQ=
+google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17/go.mod h1:J7XzRzVy1+IPwWHZUzoD0IccYZIrXILAQpc+Qy9CMhY=
+google.golang.org/genproto/googleapis/api v0.0.0-20231106174013-bbf56f31fb17 h1:JpwMPBpFN3uKhdaekDpiNlImDdkUAyiJ6ez/uxGaUSo=
+google.golang.org/genproto/googleapis/api v0.0.0-20231106174013-bbf56f31fb17/go.mod h1:0xJLfVdJqpAPl8tDg1ujOCGzx6LFLttXT5NhllGOXY4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20231120223509-83a465c0220f h1:ultW7fxlIvee4HYrtnaRPon9HpEgFk5zYpmfMgtKB5I=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20231120223509-83a465c0220f/go.mod h1:L9KNLi232K1/xB6f7AlSX692koaRnKaWSR0stBki0Yc=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
-google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60=
 google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
-google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA51WJ8=
-google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
 google.golang.org/grpc v1.59.0 h1:Z5Iec2pjwb+LEOqzpB2MR12/eKFhDPhuqW91O+4bwUk=
 google.golang.org/grpc v1.59.0/go.mod h1:aUPDwccQo6OTjy7Hct4AfBPD1GptF4fyUjIkQ9YtF98=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
@@ -695,55 +584,54 @@ google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzi
 google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
-google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.31.1-0.20231128094519-2087447a6b4a h1:4Xl+xgjbTX1HWSmJKoV3GeNdVZCJmlx2rvHT3eHoUCw=
+google.golang.org/protobuf v1.31.1-0.20231128094519-2087447a6b4a/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6 h1:jMFz6MfLP0/4fUyZle81rXUoxOBFi19VUFKVDOQfozc=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
+gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
+gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
-honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 k8s.io/api v0.28.4 h1:8ZBrLjwosLl/NYgv1P7EQLqoO8MGQApnbgH8tu3BMzY=
 k8s.io/api v0.28.4/go.mod h1:axWTGrY88s/5YE+JSt4uUi6NMM+gur1en2REMR7IRj0=
-k8s.io/apiextensions-apiserver v0.28.3 h1:Od7DEnhXHnHPZG+W9I97/fSQkVpVPQx2diy+2EtmY08=
-k8s.io/apiextensions-apiserver v0.28.3/go.mod h1:NE1XJZ4On0hS11aWWJUTNkmVB03j9LM7gJSisbRt8Lc=
+k8s.io/apiextensions-apiserver v0.28.4 h1:AZpKY/7wQ8n+ZYDtNHbAJBb+N4AXXJvyZx6ww6yAJvU=
+k8s.io/apiextensions-apiserver v0.28.4/go.mod h1:pgQIZ1U8eJSMQcENew/0ShUTlePcSGFq6dxSxf2mwPM=
 k8s.io/apimachinery v0.28.4 h1:zOSJe1mc+GxuMnFzD4Z/U1wst50X28ZNsn5bhgIIao8=
 k8s.io/apimachinery v0.28.4/go.mod h1:wI37ncBvfAoswfq626yPTe6Bz1c22L7uaJ8dho83mgg=
 k8s.io/client-go v0.28.4 h1:Np5ocjlZcTrkyRJ3+T3PkXDpe4UpatQxj85+xjaD2wY=
 k8s.io/client-go v0.28.4/go.mod h1:0VDZFpgoZfelyP5Wqu0/r/TRYcLYuJ2U1KEeoaPa1N4=
-k8s.io/component-base v0.28.3 h1:rDy68eHKxq/80RiMb2Ld/tbH8uAE75JdCqJyi6lXMzI=
-k8s.io/component-base v0.28.3/go.mod h1:fDJ6vpVNSk6cRo5wmDa6eKIG7UlIQkaFmZN2fYgIUD8=
+k8s.io/component-base v0.28.4 h1:c/iQLWPdUgI90O+T9TeECg8o7N3YJTiuz2sKxILYcYo=
+k8s.io/component-base v0.28.4/go.mod h1:m9hR0uvqXDybiGL2nf/3Lf0MerAfQXzkfWhUY58JUbU=
 k8s.io/klog/v2 v2.100.1 h1:7WCHKK6K8fNhTqfBhISHQ97KrnJNFZMcQvKp7gP/tmg=
 k8s.io/klog/v2 v2.100.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
 k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 h1:LyMgNKD2P8Wn1iAwQU5OhxCKlKJy0sHc+PcDwFB24dQ=
 k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9/go.mod h1:wZK2AVp1uHCp4VamDVgBP2COHZjqD1T68Rf0CM3YjSM=
 k8s.io/utils v0.0.0-20230726121419-3b25d923346b h1:sgn3ZU783SCgtaSJjpcVVlRqd6GSnlTLKgpAAttJvpI=
 k8s.io/utils v0.0.0-20230726121419-3b25d923346b/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+rsc.io/binaryregexp v0.2.0 h1:HfqmD5MEmC0zvwBuF187nq9mdnXjXsSivRiXN7SmRkE=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
-rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
-rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
 sigs.k8s.io/controller-runtime v0.16.3 h1:2TuvuokmfXvDUamSx1SuAOO3eTyye+47mJCigwG62c4=
 sigs.k8s.io/controller-runtime v0.16.3/go.mod h1:j7bialYoSn142nv9sCOJmQgDXQXxnroFU4VnX/brVJ0=
 sigs.k8s.io/controller-tools v0.13.0 h1:NfrvuZ4bxyolhDBt/rCZhDnx3M2hzlhgo5n3Iv2RykI=
@@ -752,5 +640,5 @@ sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMm
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
 sigs.k8s.io/structured-merge-diff/v4 v4.2.3 h1:PRbqxJClWWYMNV1dhaG4NsibJbArud9kFxnAMREiWFE=
 sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E=
-sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
-sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=
+sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
+sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
diff --git a/hack/main.go.tmpl b/hack/main.go.tmpl
index fb134ecb4..087c02d24 100644
--- a/hack/main.go.tmpl
+++ b/hack/main.go.tmpl
@@ -18,7 +18,6 @@ package main
 
 import (
 	"context"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"time"
@@ -116,6 +115,9 @@ func main() {
 			terraform.WithSharedProviderOptions(terraform.WithNativeProviderPath(*nativeProviderPath), terraform.WithNativeProviderName("registry.terraform.io/"+*nativeProviderSource)))
 	}
 
+	ctx := context.Background()
+	provider, err := config.GetProvider(ctx, false)
+	kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
 	o := tjcontroller.Options{
 		Options: xpcontroller.Options{
 			Logger:                  log,
@@ -124,9 +126,10 @@ func main() {
 			MaxConcurrentReconciles: *maxReconcileRate,
 			Features:                &feature.Flags{},
 		},
-		Provider:   config.GetProvider(),
-		SetupFn:    clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, scheduler),
-		PollJitter: pollJitter,
+		Provider:              provider,
+		SetupFn:               clients.TerraformSetupBuilder(*terraformVersion, *nativeProviderSource, *providerVersion, provider.TerraformProvider, scheduler),
+		PollJitter:            pollJitter,
+		OperationTrackerStore: tjcontroller.NewOperationStore(log),
 	}
 
 	if *enableManagementPolicies {
@@ -150,7 +153,7 @@ func main() {
 		}
 
 		// Ensure default store config exists.
-		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1alpha1.StoreConfig{
+		kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
 			TypeMeta: metav1.TypeMeta{},
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "default",
@@ -166,7 +169,6 @@ func main() {
 		})), "cannot create default store config")
 	}
 
-	rand.Seed(time.Now().UnixNano())
 	kingpin.FatalIfError(controller.Setup_{{ .Group }}(mgr, o), "Cannot setup GCP controllers")
 	kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
 }
diff --git a/internal/clients/gcp.go b/internal/clients/gcp.go
index f597f2562..eab2651d0 100644
--- a/internal/clients/gcp.go
+++ b/internal/clients/gcp.go
@@ -25,6 +25,8 @@ import (
 	"github.com/crossplane/crossplane-runtime/pkg/fieldpath"
 	"github.com/crossplane/crossplane-runtime/pkg/resource"
 	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	tfsdk "github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
 	"github.com/pkg/errors"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -94,7 +96,7 @@ func constructFederatedCredentials(providerID, serviceAccount string) ([]byte, e
 // returns Terraform provider setup configuration
 // NOTE(hasheddan): this function is slightly over our cyclomatic complexity
 // goal. Consider refactoring before adding new branches.
-func TerraformSetupBuilder(version, providerSource, providerVersion string, scheduler terraform.ProviderScheduler) terraform.SetupFn { //nolint:gocyclo
+func TerraformSetupBuilder(version, providerSource, providerVersion string, tfProvider *schema.Provider, scheduler terraform.ProviderScheduler) terraform.SetupFn { //nolint:gocyclo
 	return func(ctx context.Context, client client.Client, mg resource.Managed) (terraform.Setup, error) {
 		ps := terraform.Setup{
 			Version: version,
@@ -168,6 +170,23 @@ func TerraformSetupBuilder(version, providerSource, providerVersion string, sche
 			ps.Configuration[keyCredentials] = string(data)
 		}
 
-		return ps, nil
+		return ps, errors.Wrap(configureNoForkGCPClient(ctx, &ps, *tfProvider), "failed to configure the no-fork GCP client")
 	}
 }
+
+func configureNoForkGCPClient(ctx context.Context, ps *terraform.Setup, p schema.Provider) error {
+	// Please be aware that this implementation relies on the schema.Provider
+	// parameter `p` being a non-pointer. This is because normally
+	// the Terraform plugin SDK normally configures the provider
+	// only once and using a pointer argument here will cause
+	// race conditions between resources referring to different
+	// ProviderConfigs.
+	diag := p.Configure(context.WithoutCancel(ctx), &tfsdk.ResourceConfig{
+		Config: ps.Configuration,
+	})
+	if diag != nil && diag.HasError() {
+		return errors.Errorf("failed to configure the provider: %v", diag)
+	}
+	ps.Meta = p.Meta()
+	return nil
+}
diff --git a/internal/controller/accesscontextmanager/accesslevel/zz_controller.go b/internal/controller/accesscontextmanager/accesslevel/zz_controller.go
index 115f0a773..c2fcf9ec9 100755
--- a/internal/controller/accesscontextmanager/accesslevel/zz_controller.go
+++ b/internal/controller/accesscontextmanager/accesslevel/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/accesscontextmanager/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.AccessLevel_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AccessLevel_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AccessLevel_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_access_context_manager_access_level"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_access_context_manager_access_level"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.AccessLevel_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/accesscontextmanager/accesslevelcondition/zz_controller.go b/internal/controller/accesscontextmanager/accesslevelcondition/zz_controller.go
index f4d27cfb2..215bc6dd1 100755
--- a/internal/controller/accesscontextmanager/accesslevelcondition/zz_controller.go
+++ b/internal/controller/accesscontextmanager/accesslevelcondition/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/accesscontextmanager/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.AccessLevelCondition_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AccessLevelCondition_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AccessLevelCondition_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_access_context_manager_access_level_condition"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_access_context_manager_access_level_condition"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.AccessLevelCondition_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/accesscontextmanager/accesspolicy/zz_controller.go b/internal/controller/accesscontextmanager/accesspolicy/zz_controller.go
index 185691a7c..c7543344c 100755
--- a/internal/controller/accesscontextmanager/accesspolicy/zz_controller.go
+++ b/internal/controller/accesscontextmanager/accesspolicy/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/accesscontextmanager/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.AccessPolicy_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AccessPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AccessPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_access_context_manager_access_policy"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_access_context_manager_access_policy"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.AccessPolicy_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/accesscontextmanager/accesspolicyiammember/zz_controller.go b/internal/controller/accesscontextmanager/accesspolicyiammember/zz_controller.go
index 97da65378..330705bec 100755
--- a/internal/controller/accesscontextmanager/accesspolicyiammember/zz_controller.go
+++ b/internal/controller/accesscontextmanager/accesspolicyiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/accesscontextmanager/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.AccessPolicyIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AccessPolicyIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AccessPolicyIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_access_context_manager_access_policy_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_access_context_manager_access_policy_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.AccessPolicyIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/accesscontextmanager/serviceperimeter/zz_controller.go b/internal/controller/accesscontextmanager/serviceperimeter/zz_controller.go
index 7bed8d347..23223ce44 100755
--- a/internal/controller/accesscontextmanager/serviceperimeter/zz_controller.go
+++ b/internal/controller/accesscontextmanager/serviceperimeter/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/accesscontextmanager/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ServicePerimeter_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ServicePerimeter_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ServicePerimeter_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_access_context_manager_service_perimeter"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_access_context_manager_service_perimeter"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ServicePerimeter_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/accesscontextmanager/serviceperimeterresource/zz_controller.go b/internal/controller/accesscontextmanager/serviceperimeterresource/zz_controller.go
index 920baf945..5da1e5b25 100755
--- a/internal/controller/accesscontextmanager/serviceperimeterresource/zz_controller.go
+++ b/internal/controller/accesscontextmanager/serviceperimeterresource/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/accesscontextmanager/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ServicePerimeterResource_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ServicePerimeterResource_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ServicePerimeterResource_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_access_context_manager_service_perimeter_resource"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_access_context_manager_service_perimeter_resource"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ServicePerimeterResource_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/activedirectory/domain/zz_controller.go b/internal/controller/activedirectory/domain/zz_controller.go
index 6a2cbea88..6a625294f 100755
--- a/internal/controller/activedirectory/domain/zz_controller.go
+++ b/internal/controller/activedirectory/domain/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/activedirectory/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Domain_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Domain_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Domain_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_active_directory_domain"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_active_directory_domain"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Domain_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/alloydb/backup/zz_controller.go b/internal/controller/alloydb/backup/zz_controller.go
index 0f505a6c3..23dc7c50e 100755
--- a/internal/controller/alloydb/backup/zz_controller.go
+++ b/internal/controller/alloydb/backup/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/alloydb/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Backup_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Backup_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Backup_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_alloydb_backup"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_alloydb_backup"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Backup_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/alloydb/cluster/zz_controller.go b/internal/controller/alloydb/cluster/zz_controller.go
index 8e86febc8..496de63f0 100755
--- a/internal/controller/alloydb/cluster/zz_controller.go
+++ b/internal/controller/alloydb/cluster/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/alloydb/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Cluster_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Cluster_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Cluster_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_alloydb_cluster"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_alloydb_cluster"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Cluster_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/alloydb/instance/zz_controller.go b/internal/controller/alloydb/instance/zz_controller.go
index c30b005d6..b8e76539d 100755
--- a/internal/controller/alloydb/instance/zz_controller.go
+++ b/internal/controller/alloydb/instance/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/alloydb/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Instance_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Instance_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Instance_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_alloydb_instance"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_alloydb_instance"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Instance_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/apigee/envgroup/zz_controller.go b/internal/controller/apigee/envgroup/zz_controller.go
index 0bd3512f8..7519dd3c7 100755
--- a/internal/controller/apigee/envgroup/zz_controller.go
+++ b/internal/controller/apigee/envgroup/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/apigee/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Envgroup_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Envgroup_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Envgroup_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_apigee_envgroup"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_apigee_envgroup"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Envgroup_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/apigee/environment/zz_controller.go b/internal/controller/apigee/environment/zz_controller.go
index 4ffd3cdd0..8b4200de6 100755
--- a/internal/controller/apigee/environment/zz_controller.go
+++ b/internal/controller/apigee/environment/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/apigee/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Environment_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Environment_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Environment_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_apigee_environment"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_apigee_environment"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Environment_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/apigee/environmentiammember/zz_controller.go b/internal/controller/apigee/environmentiammember/zz_controller.go
index f3d3b56f0..4b44b5905 100755
--- a/internal/controller/apigee/environmentiammember/zz_controller.go
+++ b/internal/controller/apigee/environmentiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/apigee/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.EnvironmentIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.EnvironmentIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.EnvironmentIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_apigee_environment_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_apigee_environment_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.EnvironmentIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/apigee/instance/zz_controller.go b/internal/controller/apigee/instance/zz_controller.go
index 5c944648f..3ff2be80a 100755
--- a/internal/controller/apigee/instance/zz_controller.go
+++ b/internal/controller/apigee/instance/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/apigee/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Instance_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Instance_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Instance_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_apigee_instance"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_apigee_instance"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Instance_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/apigee/nataddress/zz_controller.go b/internal/controller/apigee/nataddress/zz_controller.go
index b750ba05d..6c1688c7e 100755
--- a/internal/controller/apigee/nataddress/zz_controller.go
+++ b/internal/controller/apigee/nataddress/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/apigee/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.NATAddress_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.NATAddress_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.NATAddress_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_apigee_nat_address"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_apigee_nat_address"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.NATAddress_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/apigee/organization/zz_controller.go b/internal/controller/apigee/organization/zz_controller.go
index 3d100e45a..9ef4a08d2 100755
--- a/internal/controller/apigee/organization/zz_controller.go
+++ b/internal/controller/apigee/organization/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/apigee/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Organization_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Organization_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Organization_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_apigee_organization"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_apigee_organization"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Organization_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/appengine/application/zz_controller.go b/internal/controller/appengine/application/zz_controller.go
index 3359d407c..110aa5f06 100755
--- a/internal/controller/appengine/application/zz_controller.go
+++ b/internal/controller/appengine/application/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/appengine/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Application_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Application_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Application_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_app_engine_application"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_app_engine_application"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Application_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/appengine/applicationurldispatchrules/zz_controller.go b/internal/controller/appengine/applicationurldispatchrules/zz_controller.go
index c18a0863e..0ed51abd5 100755
--- a/internal/controller/appengine/applicationurldispatchrules/zz_controller.go
+++ b/internal/controller/appengine/applicationurldispatchrules/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/appengine/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ApplicationURLDispatchRules_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ApplicationURLDispatchRules_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ApplicationURLDispatchRules_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_app_engine_application_url_dispatch_rules"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_app_engine_application_url_dispatch_rules"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ApplicationURLDispatchRules_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/appengine/firewallrule/zz_controller.go b/internal/controller/appengine/firewallrule/zz_controller.go
index 331c5569e..225139ba7 100755
--- a/internal/controller/appengine/firewallrule/zz_controller.go
+++ b/internal/controller/appengine/firewallrule/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/appengine/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.FirewallRule_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.FirewallRule_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.FirewallRule_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_app_engine_firewall_rule"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_app_engine_firewall_rule"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.FirewallRule_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/appengine/servicenetworksettings/zz_controller.go b/internal/controller/appengine/servicenetworksettings/zz_controller.go
index da9b67c61..f225c41a9 100755
--- a/internal/controller/appengine/servicenetworksettings/zz_controller.go
+++ b/internal/controller/appengine/servicenetworksettings/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/appengine/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ServiceNetworkSettings_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ServiceNetworkSettings_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ServiceNetworkSettings_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_app_engine_service_network_settings"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_app_engine_service_network_settings"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ServiceNetworkSettings_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/appengine/standardappversion/zz_controller.go b/internal/controller/appengine/standardappversion/zz_controller.go
index c92959137..1207b8faf 100755
--- a/internal/controller/appengine/standardappversion/zz_controller.go
+++ b/internal/controller/appengine/standardappversion/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/appengine/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.StandardAppVersion_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.StandardAppVersion_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.StandardAppVersion_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_app_engine_standard_app_version"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_app_engine_standard_app_version"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.StandardAppVersion_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/artifact/registryrepository/zz_controller.go b/internal/controller/artifact/registryrepository/zz_controller.go
index a4c94c2fa..3864bfe80 100755
--- a/internal/controller/artifact/registryrepository/zz_controller.go
+++ b/internal/controller/artifact/registryrepository/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/artifact/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.RegistryRepository_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegistryRepository_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegistryRepository_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_artifact_registry_repository"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_artifact_registry_repository"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.RegistryRepository_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/artifact/registryrepositoryiammember/zz_controller.go b/internal/controller/artifact/registryrepositoryiammember/zz_controller.go
index d549167eb..c1814c954 100755
--- a/internal/controller/artifact/registryrepositoryiammember/zz_controller.go
+++ b/internal/controller/artifact/registryrepositoryiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/artifact/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.RegistryRepositoryIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegistryRepositoryIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegistryRepositoryIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_artifact_registry_repository_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_artifact_registry_repository_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.RegistryRepositoryIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/beyondcorp/appconnection/zz_controller.go b/internal/controller/beyondcorp/appconnection/zz_controller.go
index 9f0156abe..f9cf28860 100755
--- a/internal/controller/beyondcorp/appconnection/zz_controller.go
+++ b/internal/controller/beyondcorp/appconnection/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/beyondcorp/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.AppConnection_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AppConnection_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AppConnection_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_beyondcorp_app_connection"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_beyondcorp_app_connection"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.AppConnection_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/beyondcorp/appconnector/zz_controller.go b/internal/controller/beyondcorp/appconnector/zz_controller.go
index c0d07484f..86fe4807b 100755
--- a/internal/controller/beyondcorp/appconnector/zz_controller.go
+++ b/internal/controller/beyondcorp/appconnector/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/beyondcorp/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.AppConnector_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AppConnector_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AppConnector_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_beyondcorp_app_connector"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_beyondcorp_app_connector"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.AppConnector_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/beyondcorp/appgateway/zz_controller.go b/internal/controller/beyondcorp/appgateway/zz_controller.go
index 9c8050218..161f2238f 100755
--- a/internal/controller/beyondcorp/appgateway/zz_controller.go
+++ b/internal/controller/beyondcorp/appgateway/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/beyondcorp/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.AppGateway_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AppGateway_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AppGateway_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_beyondcorp_app_gateway"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_beyondcorp_app_gateway"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.AppGateway_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigquery/analyticshubdataexchange/zz_controller.go b/internal/controller/bigquery/analyticshubdataexchange/zz_controller.go
index 09b6afc9a..c8c9c01fc 100755
--- a/internal/controller/bigquery/analyticshubdataexchange/zz_controller.go
+++ b/internal/controller/bigquery/analyticshubdataexchange/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigquery/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.AnalyticsHubDataExchange_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AnalyticsHubDataExchange_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AnalyticsHubDataExchange_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigquery_analytics_hub_data_exchange"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigquery_analytics_hub_data_exchange"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.AnalyticsHubDataExchange_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigquery/analyticshubdataexchangeiammember/zz_controller.go b/internal/controller/bigquery/analyticshubdataexchangeiammember/zz_controller.go
index c944f0994..0f3cc8901 100755
--- a/internal/controller/bigquery/analyticshubdataexchangeiammember/zz_controller.go
+++ b/internal/controller/bigquery/analyticshubdataexchangeiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigquery/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.AnalyticsHubDataExchangeIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AnalyticsHubDataExchangeIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AnalyticsHubDataExchangeIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigquery_analytics_hub_data_exchange_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigquery_analytics_hub_data_exchange_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.AnalyticsHubDataExchangeIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigquery/analyticshublisting/zz_controller.go b/internal/controller/bigquery/analyticshublisting/zz_controller.go
index 2f8b064ab..6422d17bd 100755
--- a/internal/controller/bigquery/analyticshublisting/zz_controller.go
+++ b/internal/controller/bigquery/analyticshublisting/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigquery/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.AnalyticsHubListing_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AnalyticsHubListing_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AnalyticsHubListing_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigquery_analytics_hub_listing"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigquery_analytics_hub_listing"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.AnalyticsHubListing_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigquery/connection/zz_controller.go b/internal/controller/bigquery/connection/zz_controller.go
index 02aae475e..0fd2425e5 100755
--- a/internal/controller/bigquery/connection/zz_controller.go
+++ b/internal/controller/bigquery/connection/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigquery/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Connection_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Connection_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Connection_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigquery_connection"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigquery_connection"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Connection_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigquery/dataset/zz_controller.go b/internal/controller/bigquery/dataset/zz_controller.go
index ccd7e3b2a..29dcae2e7 100755
--- a/internal/controller/bigquery/dataset/zz_controller.go
+++ b/internal/controller/bigquery/dataset/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigquery/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Dataset_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Dataset_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Dataset_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigquery_dataset"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigquery_dataset"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Dataset_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigquery/datasetaccess/zz_controller.go b/internal/controller/bigquery/datasetaccess/zz_controller.go
index 8a3ee51e0..4caf87905 100755
--- a/internal/controller/bigquery/datasetaccess/zz_controller.go
+++ b/internal/controller/bigquery/datasetaccess/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigquery/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.DatasetAccess_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DatasetAccess_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DatasetAccess_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigquery_dataset_access"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigquery_dataset_access"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.DatasetAccess_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigquery/datasetiambinding/zz_controller.go b/internal/controller/bigquery/datasetiambinding/zz_controller.go
index 23fd51e88..417c765a5 100755
--- a/internal/controller/bigquery/datasetiambinding/zz_controller.go
+++ b/internal/controller/bigquery/datasetiambinding/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigquery/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.DatasetIAMBinding_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DatasetIAMBinding_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DatasetIAMBinding_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigquery_dataset_iam_binding"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigquery_dataset_iam_binding"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.DatasetIAMBinding_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigquery/datasetiammember/zz_controller.go b/internal/controller/bigquery/datasetiammember/zz_controller.go
index 5f6d79867..ad7ef7329 100755
--- a/internal/controller/bigquery/datasetiammember/zz_controller.go
+++ b/internal/controller/bigquery/datasetiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigquery/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.DatasetIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DatasetIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DatasetIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigquery_dataset_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigquery_dataset_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.DatasetIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigquery/datasetiampolicy/zz_controller.go b/internal/controller/bigquery/datasetiampolicy/zz_controller.go
index 088548fa4..5ab7592ee 100755
--- a/internal/controller/bigquery/datasetiampolicy/zz_controller.go
+++ b/internal/controller/bigquery/datasetiampolicy/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigquery/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.DatasetIAMPolicy_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DatasetIAMPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DatasetIAMPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigquery_dataset_iam_policy"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigquery_dataset_iam_policy"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.DatasetIAMPolicy_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigquery/datatransferconfig/zz_controller.go b/internal/controller/bigquery/datatransferconfig/zz_controller.go
index 6e64b325e..44da13a8f 100755
--- a/internal/controller/bigquery/datatransferconfig/zz_controller.go
+++ b/internal/controller/bigquery/datatransferconfig/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigquery/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.DataTransferConfig_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DataTransferConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DataTransferConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigquery_data_transfer_config"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigquery_data_transfer_config"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.DataTransferConfig_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigquery/job/zz_controller.go b/internal/controller/bigquery/job/zz_controller.go
index b911291d5..a98006564 100755
--- a/internal/controller/bigquery/job/zz_controller.go
+++ b/internal/controller/bigquery/job/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigquery/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Job_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Job_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Job_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigquery_job"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigquery_job"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Job_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigquery/reservation/zz_controller.go b/internal/controller/bigquery/reservation/zz_controller.go
index 4c3bf6f7e..5d3b502b5 100755
--- a/internal/controller/bigquery/reservation/zz_controller.go
+++ b/internal/controller/bigquery/reservation/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigquery/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Reservation_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Reservation_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Reservation_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigquery_reservation"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigquery_reservation"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Reservation_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigquery/reservationassignment/zz_controller.go b/internal/controller/bigquery/reservationassignment/zz_controller.go
index 244af4b83..7c89cf560 100755
--- a/internal/controller/bigquery/reservationassignment/zz_controller.go
+++ b/internal/controller/bigquery/reservationassignment/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigquery/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ReservationAssignment_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ReservationAssignment_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ReservationAssignment_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigquery_reservation_assignment"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigquery_reservation_assignment"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ReservationAssignment_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigquery/routine/zz_controller.go b/internal/controller/bigquery/routine/zz_controller.go
index af09453d3..0ae84482b 100755
--- a/internal/controller/bigquery/routine/zz_controller.go
+++ b/internal/controller/bigquery/routine/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigquery/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Routine_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Routine_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Routine_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigquery_routine"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigquery_routine"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Routine_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigquery/table/zz_controller.go b/internal/controller/bigquery/table/zz_controller.go
index 06633b90c..2acb8723a 100755
--- a/internal/controller/bigquery/table/zz_controller.go
+++ b/internal/controller/bigquery/table/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigquery/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Table_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Table_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Table_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigquery_table"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigquery_table"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Table_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigquery/tableiambinding/zz_controller.go b/internal/controller/bigquery/tableiambinding/zz_controller.go
index 0eb2ee5b7..b305d7f59 100755
--- a/internal/controller/bigquery/tableiambinding/zz_controller.go
+++ b/internal/controller/bigquery/tableiambinding/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigquery/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.TableIAMBinding_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TableIAMBinding_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TableIAMBinding_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigquery_table_iam_binding"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigquery_table_iam_binding"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.TableIAMBinding_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigquery/tableiammember/zz_controller.go b/internal/controller/bigquery/tableiammember/zz_controller.go
index de45fb4fc..7eaed62b0 100755
--- a/internal/controller/bigquery/tableiammember/zz_controller.go
+++ b/internal/controller/bigquery/tableiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigquery/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.TableIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TableIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TableIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigquery_table_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigquery_table_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.TableIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigquery/tableiampolicy/zz_controller.go b/internal/controller/bigquery/tableiampolicy/zz_controller.go
index 53b1712f9..23db26b63 100755
--- a/internal/controller/bigquery/tableiampolicy/zz_controller.go
+++ b/internal/controller/bigquery/tableiampolicy/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigquery/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.TableIAMPolicy_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TableIAMPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TableIAMPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigquery_table_iam_policy"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigquery_table_iam_policy"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.TableIAMPolicy_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigtable/appprofile/zz_controller.go b/internal/controller/bigtable/appprofile/zz_controller.go
index 25ecce723..dedd49417 100755
--- a/internal/controller/bigtable/appprofile/zz_controller.go
+++ b/internal/controller/bigtable/appprofile/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigtable/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.AppProfile_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AppProfile_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AppProfile_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigtable_app_profile"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigtable_app_profile"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.AppProfile_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigtable/garbagecollectionpolicy/zz_controller.go b/internal/controller/bigtable/garbagecollectionpolicy/zz_controller.go
index dc3884942..720fb1796 100755
--- a/internal/controller/bigtable/garbagecollectionpolicy/zz_controller.go
+++ b/internal/controller/bigtable/garbagecollectionpolicy/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigtable/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.GarbageCollectionPolicy_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.GarbageCollectionPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.GarbageCollectionPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigtable_gc_policy"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigtable_gc_policy"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.GarbageCollectionPolicy_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigtable/instance/zz_controller.go b/internal/controller/bigtable/instance/zz_controller.go
index d58b9e183..6cc08f171 100755
--- a/internal/controller/bigtable/instance/zz_controller.go
+++ b/internal/controller/bigtable/instance/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigtable/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Instance_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Instance_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Instance_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigtable_instance"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigtable_instance"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Instance_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigtable/instanceiambinding/zz_controller.go b/internal/controller/bigtable/instanceiambinding/zz_controller.go
index a420cdbf3..d84500513 100755
--- a/internal/controller/bigtable/instanceiambinding/zz_controller.go
+++ b/internal/controller/bigtable/instanceiambinding/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigtable/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.InstanceIAMBinding_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InstanceIAMBinding_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InstanceIAMBinding_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigtable_instance_iam_binding"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigtable_instance_iam_binding"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.InstanceIAMBinding_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigtable/instanceiammember/zz_controller.go b/internal/controller/bigtable/instanceiammember/zz_controller.go
index 10b913462..3b7d00af0 100755
--- a/internal/controller/bigtable/instanceiammember/zz_controller.go
+++ b/internal/controller/bigtable/instanceiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigtable/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.InstanceIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InstanceIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InstanceIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigtable_instance_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigtable_instance_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.InstanceIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigtable/instanceiampolicy/zz_controller.go b/internal/controller/bigtable/instanceiampolicy/zz_controller.go
index 118e4984f..833f6f351 100755
--- a/internal/controller/bigtable/instanceiampolicy/zz_controller.go
+++ b/internal/controller/bigtable/instanceiampolicy/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigtable/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.InstanceIAMPolicy_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InstanceIAMPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InstanceIAMPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigtable_instance_iam_policy"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigtable_instance_iam_policy"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.InstanceIAMPolicy_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigtable/table/zz_controller.go b/internal/controller/bigtable/table/zz_controller.go
index 979ef6059..8663b4994 100755
--- a/internal/controller/bigtable/table/zz_controller.go
+++ b/internal/controller/bigtable/table/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigtable/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Table_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Table_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Table_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigtable_table"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigtable_table"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Table_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigtable/tableiambinding/zz_controller.go b/internal/controller/bigtable/tableiambinding/zz_controller.go
index e41af28d1..935d6a21a 100755
--- a/internal/controller/bigtable/tableiambinding/zz_controller.go
+++ b/internal/controller/bigtable/tableiambinding/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigtable/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.TableIAMBinding_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TableIAMBinding_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TableIAMBinding_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigtable_table_iam_binding"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigtable_table_iam_binding"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.TableIAMBinding_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigtable/tableiammember/zz_controller.go b/internal/controller/bigtable/tableiammember/zz_controller.go
index 482bfc2fa..f416406f4 100755
--- a/internal/controller/bigtable/tableiammember/zz_controller.go
+++ b/internal/controller/bigtable/tableiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigtable/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.TableIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TableIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TableIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigtable_table_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigtable_table_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.TableIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/bigtable/tableiampolicy/zz_controller.go b/internal/controller/bigtable/tableiampolicy/zz_controller.go
index 53b4d58a5..73cfb4686 100755
--- a/internal/controller/bigtable/tableiampolicy/zz_controller.go
+++ b/internal/controller/bigtable/tableiampolicy/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/bigtable/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.TableIAMPolicy_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TableIAMPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TableIAMPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_bigtable_table_iam_policy"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_bigtable_table_iam_policy"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.TableIAMPolicy_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/binaryauthorization/attestor/zz_controller.go b/internal/controller/binaryauthorization/attestor/zz_controller.go
index b492c7fb2..ed44920ad 100755
--- a/internal/controller/binaryauthorization/attestor/zz_controller.go
+++ b/internal/controller/binaryauthorization/attestor/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/binaryauthorization/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Attestor_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Attestor_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Attestor_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_binary_authorization_attestor"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_binary_authorization_attestor"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Attestor_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/binaryauthorization/policy/zz_controller.go b/internal/controller/binaryauthorization/policy/zz_controller.go
index d3c789c4a..9e307dd21 100755
--- a/internal/controller/binaryauthorization/policy/zz_controller.go
+++ b/internal/controller/binaryauthorization/policy/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/binaryauthorization/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Policy_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Policy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Policy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_binary_authorization_policy"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_binary_authorization_policy"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Policy_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/certificatemanager/certificate/zz_controller.go b/internal/controller/certificatemanager/certificate/zz_controller.go
index 50a71b6fe..dd37e70d8 100755
--- a/internal/controller/certificatemanager/certificate/zz_controller.go
+++ b/internal/controller/certificatemanager/certificate/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/certificatemanager/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Certificate_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Certificate_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Certificate_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_certificate_manager_certificate"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_certificate_manager_certificate"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Certificate_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/certificatemanager/certificatemap/zz_controller.go b/internal/controller/certificatemanager/certificatemap/zz_controller.go
index bc1995ebd..0f4072d02 100755
--- a/internal/controller/certificatemanager/certificatemap/zz_controller.go
+++ b/internal/controller/certificatemanager/certificatemap/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/certificatemanager/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.CertificateMap_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.CertificateMap_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.CertificateMap_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_certificate_manager_certificate_map"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_certificate_manager_certificate_map"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.CertificateMap_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/certificatemanager/certificatemapentry/zz_controller.go b/internal/controller/certificatemanager/certificatemapentry/zz_controller.go
index 25541c187..53a45dfbf 100755
--- a/internal/controller/certificatemanager/certificatemapentry/zz_controller.go
+++ b/internal/controller/certificatemanager/certificatemapentry/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/certificatemanager/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.CertificateMapEntry_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.CertificateMapEntry_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.CertificateMapEntry_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_certificate_manager_certificate_map_entry"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_certificate_manager_certificate_map_entry"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.CertificateMapEntry_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/certificatemanager/dnsauthorization/zz_controller.go b/internal/controller/certificatemanager/dnsauthorization/zz_controller.go
index 394351a0b..6ebbb9865 100755
--- a/internal/controller/certificatemanager/dnsauthorization/zz_controller.go
+++ b/internal/controller/certificatemanager/dnsauthorization/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/certificatemanager/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.DNSAuthorization_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DNSAuthorization_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DNSAuthorization_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_certificate_manager_dns_authorization"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_certificate_manager_dns_authorization"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.DNSAuthorization_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloud/idsendpoint/zz_controller.go b/internal/controller/cloud/idsendpoint/zz_controller.go
index 36b643f68..aa44e66c6 100755
--- a/internal/controller/cloud/idsendpoint/zz_controller.go
+++ b/internal/controller/cloud/idsendpoint/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloud/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.IdsEndpoint_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.IdsEndpoint_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.IdsEndpoint_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_cloud_ids_endpoint"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_cloud_ids_endpoint"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.IdsEndpoint_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudbuild/trigger/zz_controller.go b/internal/controller/cloudbuild/trigger/zz_controller.go
index de24ec4a5..bc4bc38ad 100755
--- a/internal/controller/cloudbuild/trigger/zz_controller.go
+++ b/internal/controller/cloudbuild/trigger/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudbuild/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Trigger_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Trigger_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Trigger_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_cloudbuild_trigger"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_cloudbuild_trigger"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Trigger_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudbuild/workerpool/zz_controller.go b/internal/controller/cloudbuild/workerpool/zz_controller.go
index 4aa538faf..712c5ef55 100755
--- a/internal/controller/cloudbuild/workerpool/zz_controller.go
+++ b/internal/controller/cloudbuild/workerpool/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudbuild/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.WorkerPool_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.WorkerPool_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.WorkerPool_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_cloudbuild_worker_pool"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_cloudbuild_worker_pool"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.WorkerPool_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudfunctions/function/zz_controller.go b/internal/controller/cloudfunctions/function/zz_controller.go
index 7bb11d5bd..1378f9839 100755
--- a/internal/controller/cloudfunctions/function/zz_controller.go
+++ b/internal/controller/cloudfunctions/function/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudfunctions/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Function_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Function_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Function_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_cloudfunctions_function"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_cloudfunctions_function"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Function_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudfunctions/functioniammember/zz_controller.go b/internal/controller/cloudfunctions/functioniammember/zz_controller.go
index 1f868b282..70633f604 100755
--- a/internal/controller/cloudfunctions/functioniammember/zz_controller.go
+++ b/internal/controller/cloudfunctions/functioniammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudfunctions/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.FunctionIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.FunctionIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.FunctionIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_cloudfunctions_function_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_cloudfunctions_function_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.FunctionIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudfunctions2/function/zz_controller.go b/internal/controller/cloudfunctions2/function/zz_controller.go
index 6fc44411f..bb2d78cd5 100755
--- a/internal/controller/cloudfunctions2/function/zz_controller.go
+++ b/internal/controller/cloudfunctions2/function/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudfunctions2/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Function_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Function_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Function_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_cloudfunctions2_function"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_cloudfunctions2_function"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Function_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudiot/device/zz_controller.go b/internal/controller/cloudiot/device/zz_controller.go
index 02d86fca3..12e945e51 100755
--- a/internal/controller/cloudiot/device/zz_controller.go
+++ b/internal/controller/cloudiot/device/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudiot/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Device_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Device_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Device_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_cloudiot_device"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_cloudiot_device"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Device_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudiot/registry/zz_controller.go b/internal/controller/cloudiot/registry/zz_controller.go
index 178c739aa..b2cc5b5d8 100755
--- a/internal/controller/cloudiot/registry/zz_controller.go
+++ b/internal/controller/cloudiot/registry/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudiot/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Registry_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Registry_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Registry_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_cloudiot_registry"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_cloudiot_registry"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Registry_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudplatform/folder/zz_controller.go b/internal/controller/cloudplatform/folder/zz_controller.go
index b7cb6b475..3711bdab6 100755
--- a/internal/controller/cloudplatform/folder/zz_controller.go
+++ b/internal/controller/cloudplatform/folder/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudplatform/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Folder_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Folder_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Folder_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_folder"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_folder"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Folder_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudplatform/folderiammember/zz_controller.go b/internal/controller/cloudplatform/folderiammember/zz_controller.go
index 81b3a1ca9..7dbb0fdf7 100755
--- a/internal/controller/cloudplatform/folderiammember/zz_controller.go
+++ b/internal/controller/cloudplatform/folderiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudplatform/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.FolderIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.FolderIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.FolderIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_folder_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_folder_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.FolderIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudplatform/organizationiamauditconfig/zz_controller.go b/internal/controller/cloudplatform/organizationiamauditconfig/zz_controller.go
index 657e154a9..62bef07dd 100755
--- a/internal/controller/cloudplatform/organizationiamauditconfig/zz_controller.go
+++ b/internal/controller/cloudplatform/organizationiamauditconfig/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudplatform/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.OrganizationIAMAuditConfig_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.OrganizationIAMAuditConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.OrganizationIAMAuditConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_organization_iam_audit_config"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_organization_iam_audit_config"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.OrganizationIAMAuditConfig_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudplatform/organizationiamcustomrole/zz_controller.go b/internal/controller/cloudplatform/organizationiamcustomrole/zz_controller.go
index 188bebc3e..6fd8c11fb 100755
--- a/internal/controller/cloudplatform/organizationiamcustomrole/zz_controller.go
+++ b/internal/controller/cloudplatform/organizationiamcustomrole/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudplatform/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.OrganizationIAMCustomRole_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.OrganizationIAMCustomRole_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.OrganizationIAMCustomRole_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_organization_iam_custom_role"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_organization_iam_custom_role"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.OrganizationIAMCustomRole_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudplatform/organizationiammember/zz_controller.go b/internal/controller/cloudplatform/organizationiammember/zz_controller.go
index 7385b1fc0..859821f93 100755
--- a/internal/controller/cloudplatform/organizationiammember/zz_controller.go
+++ b/internal/controller/cloudplatform/organizationiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudplatform/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.OrganizationIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.OrganizationIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.OrganizationIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_organization_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_organization_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.OrganizationIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudplatform/project/zz_controller.go b/internal/controller/cloudplatform/project/zz_controller.go
index a5cf466b8..b32140c29 100755
--- a/internal/controller/cloudplatform/project/zz_controller.go
+++ b/internal/controller/cloudplatform/project/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudplatform/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Project_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Project_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Project_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_project"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_project"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Project_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudplatform/projectdefaultserviceaccounts/zz_controller.go b/internal/controller/cloudplatform/projectdefaultserviceaccounts/zz_controller.go
index b81fd943d..b97f7eb98 100755
--- a/internal/controller/cloudplatform/projectdefaultserviceaccounts/zz_controller.go
+++ b/internal/controller/cloudplatform/projectdefaultserviceaccounts/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudplatform/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ProjectDefaultServiceAccounts_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ProjectDefaultServiceAccounts_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ProjectDefaultServiceAccounts_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_project_default_service_accounts"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_project_default_service_accounts"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ProjectDefaultServiceAccounts_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudplatform/projectiamauditconfig/zz_controller.go b/internal/controller/cloudplatform/projectiamauditconfig/zz_controller.go
index acdea6cd6..6ab1214f5 100755
--- a/internal/controller/cloudplatform/projectiamauditconfig/zz_controller.go
+++ b/internal/controller/cloudplatform/projectiamauditconfig/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudplatform/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ProjectIAMAuditConfig_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ProjectIAMAuditConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ProjectIAMAuditConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_project_iam_audit_config"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_project_iam_audit_config"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ProjectIAMAuditConfig_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudplatform/projectiamcustomrole/zz_controller.go b/internal/controller/cloudplatform/projectiamcustomrole/zz_controller.go
index 5e344268e..b26505423 100755
--- a/internal/controller/cloudplatform/projectiamcustomrole/zz_controller.go
+++ b/internal/controller/cloudplatform/projectiamcustomrole/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudplatform/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ProjectIAMCustomRole_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ProjectIAMCustomRole_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ProjectIAMCustomRole_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_project_iam_custom_role"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_project_iam_custom_role"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ProjectIAMCustomRole_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudplatform/projectiammember/zz_controller.go b/internal/controller/cloudplatform/projectiammember/zz_controller.go
index 6991fca12..69cb71806 100755
--- a/internal/controller/cloudplatform/projectiammember/zz_controller.go
+++ b/internal/controller/cloudplatform/projectiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudplatform/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ProjectIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ProjectIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ProjectIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_project_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_project_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ProjectIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudplatform/projectservice/zz_controller.go b/internal/controller/cloudplatform/projectservice/zz_controller.go
index ecfddc642..1824d95b4 100755
--- a/internal/controller/cloudplatform/projectservice/zz_controller.go
+++ b/internal/controller/cloudplatform/projectservice/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudplatform/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ProjectService_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ProjectService_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ProjectService_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_project_service"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_project_service"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ProjectService_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudplatform/projectusageexportbucket/zz_controller.go b/internal/controller/cloudplatform/projectusageexportbucket/zz_controller.go
index b02b788ce..a8d853431 100755
--- a/internal/controller/cloudplatform/projectusageexportbucket/zz_controller.go
+++ b/internal/controller/cloudplatform/projectusageexportbucket/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudplatform/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ProjectUsageExportBucket_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ProjectUsageExportBucket_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ProjectUsageExportBucket_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_project_usage_export_bucket"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_project_usage_export_bucket"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ProjectUsageExportBucket_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudplatform/serviceaccount/zz_controller.go b/internal/controller/cloudplatform/serviceaccount/zz_controller.go
index df47fe889..e42a96455 100755
--- a/internal/controller/cloudplatform/serviceaccount/zz_controller.go
+++ b/internal/controller/cloudplatform/serviceaccount/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudplatform/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ServiceAccount_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ServiceAccount_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ServiceAccount_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_service_account"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_service_account"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ServiceAccount_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudplatform/serviceaccountiammember/zz_controller.go b/internal/controller/cloudplatform/serviceaccountiammember/zz_controller.go
index 07646094c..e28d30b3d 100755
--- a/internal/controller/cloudplatform/serviceaccountiammember/zz_controller.go
+++ b/internal/controller/cloudplatform/serviceaccountiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudplatform/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ServiceAccountIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ServiceAccountIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ServiceAccountIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_service_account_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_service_account_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ServiceAccountIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudplatform/serviceaccountkey/zz_controller.go b/internal/controller/cloudplatform/serviceaccountkey/zz_controller.go
index e0720ce89..99823a776 100755
--- a/internal/controller/cloudplatform/serviceaccountkey/zz_controller.go
+++ b/internal/controller/cloudplatform/serviceaccountkey/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudplatform/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ServiceAccountKey_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ServiceAccountKey_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ServiceAccountKey_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_service_account_key"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_service_account_key"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ServiceAccountKey_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudplatform/servicenetworkingpeereddnsdomain/zz_controller.go b/internal/controller/cloudplatform/servicenetworkingpeereddnsdomain/zz_controller.go
index f1311e063..d5834df35 100755
--- a/internal/controller/cloudplatform/servicenetworkingpeereddnsdomain/zz_controller.go
+++ b/internal/controller/cloudplatform/servicenetworkingpeereddnsdomain/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudplatform/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ServiceNetworkingPeeredDNSDomain_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ServiceNetworkingPeeredDNSDomain_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ServiceNetworkingPeeredDNSDomain_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_service_networking_peered_dns_domain"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_service_networking_peered_dns_domain"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ServiceNetworkingPeeredDNSDomain_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudrun/domainmapping/zz_controller.go b/internal/controller/cloudrun/domainmapping/zz_controller.go
index af7b91a72..baac8a683 100755
--- a/internal/controller/cloudrun/domainmapping/zz_controller.go
+++ b/internal/controller/cloudrun/domainmapping/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudrun/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.DomainMapping_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DomainMapping_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DomainMapping_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_cloud_run_domain_mapping"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_cloud_run_domain_mapping"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.DomainMapping_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudrun/service/zz_controller.go b/internal/controller/cloudrun/service/zz_controller.go
index 41921bc2b..97427e7d1 100755
--- a/internal/controller/cloudrun/service/zz_controller.go
+++ b/internal/controller/cloudrun/service/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudrun/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Service_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Service_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Service_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_cloud_run_service"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_cloud_run_service"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Service_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudrun/serviceiammember/zz_controller.go b/internal/controller/cloudrun/serviceiammember/zz_controller.go
index 3fe4c3f9e..ccabaa2b5 100755
--- a/internal/controller/cloudrun/serviceiammember/zz_controller.go
+++ b/internal/controller/cloudrun/serviceiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudrun/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ServiceIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ServiceIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ServiceIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_cloud_run_service_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_cloud_run_service_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ServiceIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudrun/v2job/zz_controller.go b/internal/controller/cloudrun/v2job/zz_controller.go
index c7eff89ae..be18e820e 100755
--- a/internal/controller/cloudrun/v2job/zz_controller.go
+++ b/internal/controller/cloudrun/v2job/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudrun/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.V2Job_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.V2Job_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.V2Job_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_cloud_run_v2_job"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_cloud_run_v2_job"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.V2Job_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudrun/v2service/zz_controller.go b/internal/controller/cloudrun/v2service/zz_controller.go
index 11d05dabf..ed9db2cba 100755
--- a/internal/controller/cloudrun/v2service/zz_controller.go
+++ b/internal/controller/cloudrun/v2service/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudrun/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.V2Service_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.V2Service_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.V2Service_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_cloud_run_v2_service"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_cloud_run_v2_service"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.V2Service_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudscheduler/job/zz_controller.go b/internal/controller/cloudscheduler/job/zz_controller.go
index 568a2301d..bfb052e37 100755
--- a/internal/controller/cloudscheduler/job/zz_controller.go
+++ b/internal/controller/cloudscheduler/job/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudscheduler/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Job_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Job_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Job_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_cloud_scheduler_job"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_cloud_scheduler_job"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Job_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/cloudtasks/queue/zz_controller.go b/internal/controller/cloudtasks/queue/zz_controller.go
index 6636d2930..34735ce77 100755
--- a/internal/controller/cloudtasks/queue/zz_controller.go
+++ b/internal/controller/cloudtasks/queue/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/cloudtasks/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Queue_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Queue_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Queue_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_cloud_tasks_queue"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_cloud_tasks_queue"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Queue_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/composer/environment/zz_controller.go b/internal/controller/composer/environment/zz_controller.go
index cc7d6665e..705810317 100755
--- a/internal/controller/composer/environment/zz_controller.go
+++ b/internal/controller/composer/environment/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/composer/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Environment_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Environment_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Environment_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_composer_environment"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_composer_environment"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Environment_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/address/zz_controller.go b/internal/controller/compute/address/zz_controller.go
index 27dc57148..56cca2483 100755
--- a/internal/controller/compute/address/zz_controller.go
+++ b/internal/controller/compute/address/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Address_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Address_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Address_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_address"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_address"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Address_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/attacheddisk/zz_controller.go b/internal/controller/compute/attacheddisk/zz_controller.go
index ca3ef7bbd..8787cb0e5 100755
--- a/internal/controller/compute/attacheddisk/zz_controller.go
+++ b/internal/controller/compute/attacheddisk/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.AttachedDisk_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AttachedDisk_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AttachedDisk_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_attached_disk"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_attached_disk"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.AttachedDisk_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/autoscaler/zz_controller.go b/internal/controller/compute/autoscaler/zz_controller.go
index dce4b2628..41b86a849 100755
--- a/internal/controller/compute/autoscaler/zz_controller.go
+++ b/internal/controller/compute/autoscaler/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Autoscaler_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Autoscaler_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Autoscaler_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_autoscaler"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_autoscaler"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Autoscaler_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/backendbucket/zz_controller.go b/internal/controller/compute/backendbucket/zz_controller.go
index 581159e04..6e686a3f0 100755
--- a/internal/controller/compute/backendbucket/zz_controller.go
+++ b/internal/controller/compute/backendbucket/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.BackendBucket_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.BackendBucket_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.BackendBucket_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_backend_bucket"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_backend_bucket"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.BackendBucket_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/backendbucketsignedurlkey/zz_controller.go b/internal/controller/compute/backendbucketsignedurlkey/zz_controller.go
index d538e94b8..ed16c3106 100755
--- a/internal/controller/compute/backendbucketsignedurlkey/zz_controller.go
+++ b/internal/controller/compute/backendbucketsignedurlkey/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.BackendBucketSignedURLKey_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.BackendBucketSignedURLKey_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.BackendBucketSignedURLKey_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_backend_bucket_signed_url_key"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_backend_bucket_signed_url_key"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.BackendBucketSignedURLKey_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/backendservice/zz_controller.go b/internal/controller/compute/backendservice/zz_controller.go
index fdbeccf13..b8f38da06 100755
--- a/internal/controller/compute/backendservice/zz_controller.go
+++ b/internal/controller/compute/backendservice/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.BackendService_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.BackendService_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.BackendService_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_backend_service"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_backend_service"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.BackendService_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/backendservicesignedurlkey/zz_controller.go b/internal/controller/compute/backendservicesignedurlkey/zz_controller.go
index 322467cc1..cf06f446a 100755
--- a/internal/controller/compute/backendservicesignedurlkey/zz_controller.go
+++ b/internal/controller/compute/backendservicesignedurlkey/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.BackendServiceSignedURLKey_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.BackendServiceSignedURLKey_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.BackendServiceSignedURLKey_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_backend_service_signed_url_key"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_backend_service_signed_url_key"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.BackendServiceSignedURLKey_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/disk/zz_controller.go b/internal/controller/compute/disk/zz_controller.go
index 5fb18c0a2..bcbdb4779 100755
--- a/internal/controller/compute/disk/zz_controller.go
+++ b/internal/controller/compute/disk/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Disk_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Disk_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Disk_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_disk"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_disk"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Disk_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/diskiammember/zz_controller.go b/internal/controller/compute/diskiammember/zz_controller.go
index 52e865015..7bf2bf1c7 100755
--- a/internal/controller/compute/diskiammember/zz_controller.go
+++ b/internal/controller/compute/diskiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.DiskIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DiskIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DiskIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_disk_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_disk_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.DiskIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/diskresourcepolicyattachment/zz_controller.go b/internal/controller/compute/diskresourcepolicyattachment/zz_controller.go
index a3297bf83..d6ee8cbdb 100755
--- a/internal/controller/compute/diskresourcepolicyattachment/zz_controller.go
+++ b/internal/controller/compute/diskresourcepolicyattachment/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.DiskResourcePolicyAttachment_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DiskResourcePolicyAttachment_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DiskResourcePolicyAttachment_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_disk_resource_policy_attachment"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_disk_resource_policy_attachment"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.DiskResourcePolicyAttachment_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/externalvpngateway/zz_controller.go b/internal/controller/compute/externalvpngateway/zz_controller.go
index fcda05890..673b2beb6 100755
--- a/internal/controller/compute/externalvpngateway/zz_controller.go
+++ b/internal/controller/compute/externalvpngateway/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ExternalVPNGateway_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ExternalVPNGateway_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ExternalVPNGateway_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_external_vpn_gateway"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_external_vpn_gateway"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ExternalVPNGateway_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/firewall/zz_controller.go b/internal/controller/compute/firewall/zz_controller.go
index a0b28faa3..736ea668e 100755
--- a/internal/controller/compute/firewall/zz_controller.go
+++ b/internal/controller/compute/firewall/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Firewall_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Firewall_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Firewall_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_firewall"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_firewall"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Firewall_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/firewallpolicy/zz_controller.go b/internal/controller/compute/firewallpolicy/zz_controller.go
index fcfdc40d6..0484b28ce 100755
--- a/internal/controller/compute/firewallpolicy/zz_controller.go
+++ b/internal/controller/compute/firewallpolicy/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.FirewallPolicy_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.FirewallPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.FirewallPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_firewall_policy"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_firewall_policy"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.FirewallPolicy_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/firewallpolicyassociation/zz_controller.go b/internal/controller/compute/firewallpolicyassociation/zz_controller.go
index 659dd7ae5..98fa8c8f3 100755
--- a/internal/controller/compute/firewallpolicyassociation/zz_controller.go
+++ b/internal/controller/compute/firewallpolicyassociation/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.FirewallPolicyAssociation_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.FirewallPolicyAssociation_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.FirewallPolicyAssociation_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_firewall_policy_association"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_firewall_policy_association"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.FirewallPolicyAssociation_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/firewallpolicyrule/zz_controller.go b/internal/controller/compute/firewallpolicyrule/zz_controller.go
index 9bb4dc88e..abd2eb509 100755
--- a/internal/controller/compute/firewallpolicyrule/zz_controller.go
+++ b/internal/controller/compute/firewallpolicyrule/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.FirewallPolicyRule_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.FirewallPolicyRule_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.FirewallPolicyRule_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_firewall_policy_rule"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_firewall_policy_rule"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.FirewallPolicyRule_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/forwardingrule/zz_controller.go b/internal/controller/compute/forwardingrule/zz_controller.go
index acdfb34a9..81b105640 100755
--- a/internal/controller/compute/forwardingrule/zz_controller.go
+++ b/internal/controller/compute/forwardingrule/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ForwardingRule_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ForwardingRule_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ForwardingRule_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_forwarding_rule"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_forwarding_rule"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ForwardingRule_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/globaladdress/zz_controller.go b/internal/controller/compute/globaladdress/zz_controller.go
index 3cb0ae7cc..d7ca8a5dc 100755
--- a/internal/controller/compute/globaladdress/zz_controller.go
+++ b/internal/controller/compute/globaladdress/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.GlobalAddress_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.GlobalAddress_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.GlobalAddress_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_global_address"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_global_address"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.GlobalAddress_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/globalforwardingrule/zz_controller.go b/internal/controller/compute/globalforwardingrule/zz_controller.go
index 05b4e58b1..6b7a56668 100755
--- a/internal/controller/compute/globalforwardingrule/zz_controller.go
+++ b/internal/controller/compute/globalforwardingrule/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.GlobalForwardingRule_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.GlobalForwardingRule_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.GlobalForwardingRule_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_global_forwarding_rule"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_global_forwarding_rule"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.GlobalForwardingRule_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/globalnetworkendpoint/zz_controller.go b/internal/controller/compute/globalnetworkendpoint/zz_controller.go
index 7fcdcd585..c9652701a 100755
--- a/internal/controller/compute/globalnetworkendpoint/zz_controller.go
+++ b/internal/controller/compute/globalnetworkendpoint/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.GlobalNetworkEndpoint_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.GlobalNetworkEndpoint_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.GlobalNetworkEndpoint_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_global_network_endpoint"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_global_network_endpoint"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.GlobalNetworkEndpoint_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/globalnetworkendpointgroup/zz_controller.go b/internal/controller/compute/globalnetworkendpointgroup/zz_controller.go
index cf1092529..50acdb60b 100755
--- a/internal/controller/compute/globalnetworkendpointgroup/zz_controller.go
+++ b/internal/controller/compute/globalnetworkendpointgroup/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.GlobalNetworkEndpointGroup_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.GlobalNetworkEndpointGroup_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.GlobalNetworkEndpointGroup_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_global_network_endpoint_group"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_global_network_endpoint_group"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.GlobalNetworkEndpointGroup_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/havpngateway/zz_controller.go b/internal/controller/compute/havpngateway/zz_controller.go
index e07a0a111..b995b3f08 100755
--- a/internal/controller/compute/havpngateway/zz_controller.go
+++ b/internal/controller/compute/havpngateway/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.HaVPNGateway_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.HaVPNGateway_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.HaVPNGateway_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_ha_vpn_gateway"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_ha_vpn_gateway"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.HaVPNGateway_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/healthcheck/zz_controller.go b/internal/controller/compute/healthcheck/zz_controller.go
index d33f341ee..d3ed8eee2 100755
--- a/internal/controller/compute/healthcheck/zz_controller.go
+++ b/internal/controller/compute/healthcheck/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.HealthCheck_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.HealthCheck_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.HealthCheck_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_health_check"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_health_check"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.HealthCheck_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/httphealthcheck/zz_controller.go b/internal/controller/compute/httphealthcheck/zz_controller.go
index 536a72cf7..f97c92265 100755
--- a/internal/controller/compute/httphealthcheck/zz_controller.go
+++ b/internal/controller/compute/httphealthcheck/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.HTTPHealthCheck_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.HTTPHealthCheck_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.HTTPHealthCheck_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_http_health_check"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_http_health_check"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.HTTPHealthCheck_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/httpshealthcheck/zz_controller.go b/internal/controller/compute/httpshealthcheck/zz_controller.go
index 9a6ff3ae8..45e675d7e 100755
--- a/internal/controller/compute/httpshealthcheck/zz_controller.go
+++ b/internal/controller/compute/httpshealthcheck/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.HTTPSHealthCheck_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.HTTPSHealthCheck_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.HTTPSHealthCheck_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_https_health_check"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_https_health_check"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.HTTPSHealthCheck_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/image/zz_controller.go b/internal/controller/compute/image/zz_controller.go
index 3484b4bfe..0a337372a 100755
--- a/internal/controller/compute/image/zz_controller.go
+++ b/internal/controller/compute/image/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Image_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Image_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Image_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_image"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_image"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Image_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/imageiammember/zz_controller.go b/internal/controller/compute/imageiammember/zz_controller.go
index b1afcd4af..838eb8bec 100755
--- a/internal/controller/compute/imageiammember/zz_controller.go
+++ b/internal/controller/compute/imageiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ImageIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ImageIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ImageIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_image_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_image_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ImageIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/instance/zz_controller.go b/internal/controller/compute/instance/zz_controller.go
index def574b29..5e2977de5 100755
--- a/internal/controller/compute/instance/zz_controller.go
+++ b/internal/controller/compute/instance/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Instance_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Instance_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Instance_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_instance"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_instance"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Instance_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/instancefromtemplate/zz_controller.go b/internal/controller/compute/instancefromtemplate/zz_controller.go
index d30382e23..bd2bfc3a5 100755
--- a/internal/controller/compute/instancefromtemplate/zz_controller.go
+++ b/internal/controller/compute/instancefromtemplate/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.InstanceFromTemplate_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InstanceFromTemplate_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InstanceFromTemplate_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_instance_from_template"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_instance_from_template"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.InstanceFromTemplate_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/instancegroup/zz_controller.go b/internal/controller/compute/instancegroup/zz_controller.go
index a36c65db6..e1b3b6a50 100755
--- a/internal/controller/compute/instancegroup/zz_controller.go
+++ b/internal/controller/compute/instancegroup/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.InstanceGroup_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InstanceGroup_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InstanceGroup_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_instance_group"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_instance_group"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.InstanceGroup_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/instancegroupmanager/zz_controller.go b/internal/controller/compute/instancegroupmanager/zz_controller.go
index df57aaea4..9a48e29be 100755
--- a/internal/controller/compute/instancegroupmanager/zz_controller.go
+++ b/internal/controller/compute/instancegroupmanager/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.InstanceGroupManager_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InstanceGroupManager_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InstanceGroupManager_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_instance_group_manager"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_instance_group_manager"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.InstanceGroupManager_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/instancegroupnamedport/zz_controller.go b/internal/controller/compute/instancegroupnamedport/zz_controller.go
index 85fa977d7..2c91b7f3f 100755
--- a/internal/controller/compute/instancegroupnamedport/zz_controller.go
+++ b/internal/controller/compute/instancegroupnamedport/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.InstanceGroupNamedPort_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InstanceGroupNamedPort_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InstanceGroupNamedPort_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_instance_group_named_port"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_instance_group_named_port"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.InstanceGroupNamedPort_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/instanceiammember/zz_controller.go b/internal/controller/compute/instanceiammember/zz_controller.go
index b5c7ec053..586ab0f44 100755
--- a/internal/controller/compute/instanceiammember/zz_controller.go
+++ b/internal/controller/compute/instanceiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.InstanceIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InstanceIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InstanceIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_instance_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_instance_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.InstanceIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/instancetemplate/zz_controller.go b/internal/controller/compute/instancetemplate/zz_controller.go
index 806052d8b..683a7da71 100755
--- a/internal/controller/compute/instancetemplate/zz_controller.go
+++ b/internal/controller/compute/instancetemplate/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.InstanceTemplate_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InstanceTemplate_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InstanceTemplate_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_instance_template"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_instance_template"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.InstanceTemplate_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/interconnectattachment/zz_controller.go b/internal/controller/compute/interconnectattachment/zz_controller.go
index 70a32c20f..7d8ce33ed 100755
--- a/internal/controller/compute/interconnectattachment/zz_controller.go
+++ b/internal/controller/compute/interconnectattachment/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.InterconnectAttachment_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InterconnectAttachment_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InterconnectAttachment_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_interconnect_attachment"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_interconnect_attachment"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.InterconnectAttachment_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/managedsslcertificate/zz_controller.go b/internal/controller/compute/managedsslcertificate/zz_controller.go
index 8660088a0..f2bcbf107 100755
--- a/internal/controller/compute/managedsslcertificate/zz_controller.go
+++ b/internal/controller/compute/managedsslcertificate/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ManagedSSLCertificate_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ManagedSSLCertificate_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ManagedSSLCertificate_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_managed_ssl_certificate"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_managed_ssl_certificate"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ManagedSSLCertificate_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/network/zz_controller.go b/internal/controller/compute/network/zz_controller.go
index cfa5747d8..541ababf9 100755
--- a/internal/controller/compute/network/zz_controller.go
+++ b/internal/controller/compute/network/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Network_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Network_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Network_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_network"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_network"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Network_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/networkendpoint/zz_controller.go b/internal/controller/compute/networkendpoint/zz_controller.go
index 310a51f33..387564b0c 100755
--- a/internal/controller/compute/networkendpoint/zz_controller.go
+++ b/internal/controller/compute/networkendpoint/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.NetworkEndpoint_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.NetworkEndpoint_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.NetworkEndpoint_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_network_endpoint"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_network_endpoint"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.NetworkEndpoint_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/networkendpointgroup/zz_controller.go b/internal/controller/compute/networkendpointgroup/zz_controller.go
index 898cdfee9..0c460ff4d 100755
--- a/internal/controller/compute/networkendpointgroup/zz_controller.go
+++ b/internal/controller/compute/networkendpointgroup/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.NetworkEndpointGroup_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.NetworkEndpointGroup_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.NetworkEndpointGroup_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_network_endpoint_group"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_network_endpoint_group"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.NetworkEndpointGroup_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/networkfirewallpolicy/zz_controller.go b/internal/controller/compute/networkfirewallpolicy/zz_controller.go
index 01f62049f..a68ad2bee 100755
--- a/internal/controller/compute/networkfirewallpolicy/zz_controller.go
+++ b/internal/controller/compute/networkfirewallpolicy/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.NetworkFirewallPolicy_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.NetworkFirewallPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.NetworkFirewallPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_network_firewall_policy"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_network_firewall_policy"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.NetworkFirewallPolicy_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/networkfirewallpolicyassociation/zz_controller.go b/internal/controller/compute/networkfirewallpolicyassociation/zz_controller.go
index 5debe0139..cee032ba1 100755
--- a/internal/controller/compute/networkfirewallpolicyassociation/zz_controller.go
+++ b/internal/controller/compute/networkfirewallpolicyassociation/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.NetworkFirewallPolicyAssociation_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.NetworkFirewallPolicyAssociation_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.NetworkFirewallPolicyAssociation_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_network_firewall_policy_association"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_network_firewall_policy_association"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.NetworkFirewallPolicyAssociation_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/networkpeering/zz_controller.go b/internal/controller/compute/networkpeering/zz_controller.go
index b7f4c594f..b26087654 100755
--- a/internal/controller/compute/networkpeering/zz_controller.go
+++ b/internal/controller/compute/networkpeering/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.NetworkPeering_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.NetworkPeering_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.NetworkPeering_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_network_peering"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_network_peering"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.NetworkPeering_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/networkpeeringroutesconfig/zz_controller.go b/internal/controller/compute/networkpeeringroutesconfig/zz_controller.go
index 4734e5691..4ac03d106 100755
--- a/internal/controller/compute/networkpeeringroutesconfig/zz_controller.go
+++ b/internal/controller/compute/networkpeeringroutesconfig/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.NetworkPeeringRoutesConfig_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.NetworkPeeringRoutesConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.NetworkPeeringRoutesConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_network_peering_routes_config"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_network_peering_routes_config"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.NetworkPeeringRoutesConfig_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/nodegroup/zz_controller.go b/internal/controller/compute/nodegroup/zz_controller.go
index ea71ffa3b..4ae06433c 100755
--- a/internal/controller/compute/nodegroup/zz_controller.go
+++ b/internal/controller/compute/nodegroup/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.NodeGroup_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.NodeGroup_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.NodeGroup_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_node_group"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_node_group"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.NodeGroup_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/nodetemplate/zz_controller.go b/internal/controller/compute/nodetemplate/zz_controller.go
index 08ea8a91d..ec8a5a4cb 100755
--- a/internal/controller/compute/nodetemplate/zz_controller.go
+++ b/internal/controller/compute/nodetemplate/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.NodeTemplate_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.NodeTemplate_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.NodeTemplate_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_node_template"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_node_template"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.NodeTemplate_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/packetmirroring/zz_controller.go b/internal/controller/compute/packetmirroring/zz_controller.go
index ac38f2ed1..54ac577a9 100755
--- a/internal/controller/compute/packetmirroring/zz_controller.go
+++ b/internal/controller/compute/packetmirroring/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.PacketMirroring_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.PacketMirroring_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.PacketMirroring_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_packet_mirroring"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_packet_mirroring"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.PacketMirroring_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/perinstanceconfig/zz_controller.go b/internal/controller/compute/perinstanceconfig/zz_controller.go
index 95b7b3923..bb96b1c3a 100755
--- a/internal/controller/compute/perinstanceconfig/zz_controller.go
+++ b/internal/controller/compute/perinstanceconfig/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.PerInstanceConfig_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.PerInstanceConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.PerInstanceConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_per_instance_config"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_per_instance_config"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.PerInstanceConfig_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/projectdefaultnetworktier/zz_controller.go b/internal/controller/compute/projectdefaultnetworktier/zz_controller.go
index 70109b1b0..cbb0eea9c 100755
--- a/internal/controller/compute/projectdefaultnetworktier/zz_controller.go
+++ b/internal/controller/compute/projectdefaultnetworktier/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ProjectDefaultNetworkTier_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ProjectDefaultNetworkTier_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ProjectDefaultNetworkTier_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_project_default_network_tier"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_project_default_network_tier"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ProjectDefaultNetworkTier_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/projectmetadata/zz_controller.go b/internal/controller/compute/projectmetadata/zz_controller.go
index 8a9591d44..81d5fb5df 100755
--- a/internal/controller/compute/projectmetadata/zz_controller.go
+++ b/internal/controller/compute/projectmetadata/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ProjectMetadata_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ProjectMetadata_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ProjectMetadata_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_project_metadata"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_project_metadata"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ProjectMetadata_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/projectmetadataitem/zz_controller.go b/internal/controller/compute/projectmetadataitem/zz_controller.go
index 8cd7de82a..d06de18f2 100755
--- a/internal/controller/compute/projectmetadataitem/zz_controller.go
+++ b/internal/controller/compute/projectmetadataitem/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ProjectMetadataItem_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ProjectMetadataItem_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ProjectMetadataItem_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_project_metadata_item"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_project_metadata_item"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ProjectMetadataItem_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/regionautoscaler/zz_controller.go b/internal/controller/compute/regionautoscaler/zz_controller.go
index 0adba0ea8..89fdfec30 100755
--- a/internal/controller/compute/regionautoscaler/zz_controller.go
+++ b/internal/controller/compute/regionautoscaler/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.RegionAutoscaler_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionAutoscaler_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionAutoscaler_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_region_autoscaler"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_region_autoscaler"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.RegionAutoscaler_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/regionbackendservice/zz_controller.go b/internal/controller/compute/regionbackendservice/zz_controller.go
index fa9e32720..1882f9d56 100755
--- a/internal/controller/compute/regionbackendservice/zz_controller.go
+++ b/internal/controller/compute/regionbackendservice/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.RegionBackendService_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionBackendService_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionBackendService_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_region_backend_service"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_region_backend_service"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.RegionBackendService_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/regiondisk/zz_controller.go b/internal/controller/compute/regiondisk/zz_controller.go
index 27fff3bca..6c49331ee 100755
--- a/internal/controller/compute/regiondisk/zz_controller.go
+++ b/internal/controller/compute/regiondisk/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.RegionDisk_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionDisk_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionDisk_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_region_disk"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_region_disk"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.RegionDisk_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/regiondiskiammember/zz_controller.go b/internal/controller/compute/regiondiskiammember/zz_controller.go
index 1df542ff8..76a5a12ec 100755
--- a/internal/controller/compute/regiondiskiammember/zz_controller.go
+++ b/internal/controller/compute/regiondiskiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.RegionDiskIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionDiskIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionDiskIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_region_disk_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_region_disk_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.RegionDiskIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/regiondiskresourcepolicyattachment/zz_controller.go b/internal/controller/compute/regiondiskresourcepolicyattachment/zz_controller.go
index 47f5a82ed..d146bf33f 100755
--- a/internal/controller/compute/regiondiskresourcepolicyattachment/zz_controller.go
+++ b/internal/controller/compute/regiondiskresourcepolicyattachment/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.RegionDiskResourcePolicyAttachment_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionDiskResourcePolicyAttachment_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionDiskResourcePolicyAttachment_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_region_disk_resource_policy_attachment"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_region_disk_resource_policy_attachment"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.RegionDiskResourcePolicyAttachment_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/regionhealthcheck/zz_controller.go b/internal/controller/compute/regionhealthcheck/zz_controller.go
index 218fe4766..ef4e43080 100755
--- a/internal/controller/compute/regionhealthcheck/zz_controller.go
+++ b/internal/controller/compute/regionhealthcheck/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.RegionHealthCheck_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionHealthCheck_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionHealthCheck_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_region_health_check"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_region_health_check"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.RegionHealthCheck_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/regioninstancegroupmanager/zz_controller.go b/internal/controller/compute/regioninstancegroupmanager/zz_controller.go
index 8c2e01f0a..5824a8cbe 100755
--- a/internal/controller/compute/regioninstancegroupmanager/zz_controller.go
+++ b/internal/controller/compute/regioninstancegroupmanager/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.RegionInstanceGroupManager_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionInstanceGroupManager_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionInstanceGroupManager_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_region_instance_group_manager"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_region_instance_group_manager"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.RegionInstanceGroupManager_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/regionnetworkendpointgroup/zz_controller.go b/internal/controller/compute/regionnetworkendpointgroup/zz_controller.go
index 894ebb7e0..44d632fb1 100755
--- a/internal/controller/compute/regionnetworkendpointgroup/zz_controller.go
+++ b/internal/controller/compute/regionnetworkendpointgroup/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.RegionNetworkEndpointGroup_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionNetworkEndpointGroup_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionNetworkEndpointGroup_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_region_network_endpoint_group"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_region_network_endpoint_group"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.RegionNetworkEndpointGroup_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/regionnetworkfirewallpolicy/zz_controller.go b/internal/controller/compute/regionnetworkfirewallpolicy/zz_controller.go
index 145b28502..44fe548c4 100755
--- a/internal/controller/compute/regionnetworkfirewallpolicy/zz_controller.go
+++ b/internal/controller/compute/regionnetworkfirewallpolicy/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.RegionNetworkFirewallPolicy_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionNetworkFirewallPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionNetworkFirewallPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_region_network_firewall_policy"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_region_network_firewall_policy"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.RegionNetworkFirewallPolicy_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/regionnetworkfirewallpolicyassociation/zz_controller.go b/internal/controller/compute/regionnetworkfirewallpolicyassociation/zz_controller.go
index e4b3d9fa2..42685854f 100755
--- a/internal/controller/compute/regionnetworkfirewallpolicyassociation/zz_controller.go
+++ b/internal/controller/compute/regionnetworkfirewallpolicyassociation/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.RegionNetworkFirewallPolicyAssociation_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionNetworkFirewallPolicyAssociation_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionNetworkFirewallPolicyAssociation_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_region_network_firewall_policy_association"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_region_network_firewall_policy_association"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.RegionNetworkFirewallPolicyAssociation_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/regionperinstanceconfig/zz_controller.go b/internal/controller/compute/regionperinstanceconfig/zz_controller.go
index a9536326e..006057cda 100755
--- a/internal/controller/compute/regionperinstanceconfig/zz_controller.go
+++ b/internal/controller/compute/regionperinstanceconfig/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.RegionPerInstanceConfig_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionPerInstanceConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionPerInstanceConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_region_per_instance_config"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_region_per_instance_config"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.RegionPerInstanceConfig_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/regionsslcertificate/zz_controller.go b/internal/controller/compute/regionsslcertificate/zz_controller.go
index 566e894bd..9f709977c 100755
--- a/internal/controller/compute/regionsslcertificate/zz_controller.go
+++ b/internal/controller/compute/regionsslcertificate/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.RegionSSLCertificate_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionSSLCertificate_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionSSLCertificate_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_region_ssl_certificate"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_region_ssl_certificate"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.RegionSSLCertificate_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/regiontargethttpproxy/zz_controller.go b/internal/controller/compute/regiontargethttpproxy/zz_controller.go
index 8f2b1ec72..86486abc8 100755
--- a/internal/controller/compute/regiontargethttpproxy/zz_controller.go
+++ b/internal/controller/compute/regiontargethttpproxy/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.RegionTargetHTTPProxy_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionTargetHTTPProxy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionTargetHTTPProxy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_region_target_http_proxy"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_region_target_http_proxy"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.RegionTargetHTTPProxy_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/regiontargethttpsproxy/zz_controller.go b/internal/controller/compute/regiontargethttpsproxy/zz_controller.go
index 41fa72b00..ce5e3cc99 100755
--- a/internal/controller/compute/regiontargethttpsproxy/zz_controller.go
+++ b/internal/controller/compute/regiontargethttpsproxy/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.RegionTargetHTTPSProxy_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionTargetHTTPSProxy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionTargetHTTPSProxy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_region_target_https_proxy"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_region_target_https_proxy"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.RegionTargetHTTPSProxy_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/regionurlmap/zz_controller.go b/internal/controller/compute/regionurlmap/zz_controller.go
index f185fd9df..2e462d040 100755
--- a/internal/controller/compute/regionurlmap/zz_controller.go
+++ b/internal/controller/compute/regionurlmap/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.RegionURLMap_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionURLMap_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RegionURLMap_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_region_url_map"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_region_url_map"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.RegionURLMap_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/reservation/zz_controller.go b/internal/controller/compute/reservation/zz_controller.go
index d8c17b64a..cd00b07c3 100755
--- a/internal/controller/compute/reservation/zz_controller.go
+++ b/internal/controller/compute/reservation/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Reservation_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Reservation_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Reservation_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_reservation"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_reservation"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Reservation_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/resourcepolicy/zz_controller.go b/internal/controller/compute/resourcepolicy/zz_controller.go
index f3288425d..493419008 100755
--- a/internal/controller/compute/resourcepolicy/zz_controller.go
+++ b/internal/controller/compute/resourcepolicy/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ResourcePolicy_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ResourcePolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ResourcePolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_resource_policy"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_resource_policy"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ResourcePolicy_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/route/zz_controller.go b/internal/controller/compute/route/zz_controller.go
index cee852718..ff413c2cf 100755
--- a/internal/controller/compute/route/zz_controller.go
+++ b/internal/controller/compute/route/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Route_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Route_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Route_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_route"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_route"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Route_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/router/zz_controller.go b/internal/controller/compute/router/zz_controller.go
index d39c27221..4432bd7f5 100755
--- a/internal/controller/compute/router/zz_controller.go
+++ b/internal/controller/compute/router/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Router_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Router_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Router_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_router"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_router"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Router_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/routerinterface/zz_controller.go b/internal/controller/compute/routerinterface/zz_controller.go
index 614b506e9..a9bd2fba1 100755
--- a/internal/controller/compute/routerinterface/zz_controller.go
+++ b/internal/controller/compute/routerinterface/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.RouterInterface_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RouterInterface_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RouterInterface_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_router_interface"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_router_interface"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.RouterInterface_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/routernat/zz_controller.go b/internal/controller/compute/routernat/zz_controller.go
index 5677edf37..4e7164d47 100755
--- a/internal/controller/compute/routernat/zz_controller.go
+++ b/internal/controller/compute/routernat/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.RouterNAT_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RouterNAT_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RouterNAT_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_router_nat"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_router_nat"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.RouterNAT_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/routerpeer/zz_controller.go b/internal/controller/compute/routerpeer/zz_controller.go
index c5b0d3d15..4effa754b 100755
--- a/internal/controller/compute/routerpeer/zz_controller.go
+++ b/internal/controller/compute/routerpeer/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.RouterPeer_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RouterPeer_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RouterPeer_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_router_peer"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_router_peer"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.RouterPeer_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/securitypolicy/zz_controller.go b/internal/controller/compute/securitypolicy/zz_controller.go
index c8a2de73f..2fdcb55de 100755
--- a/internal/controller/compute/securitypolicy/zz_controller.go
+++ b/internal/controller/compute/securitypolicy/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.SecurityPolicy_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SecurityPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SecurityPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_security_policy"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_security_policy"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.SecurityPolicy_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/serviceattachment/zz_controller.go b/internal/controller/compute/serviceattachment/zz_controller.go
index 75c3e2de6..61c5ba18a 100755
--- a/internal/controller/compute/serviceattachment/zz_controller.go
+++ b/internal/controller/compute/serviceattachment/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ServiceAttachment_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ServiceAttachment_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ServiceAttachment_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_service_attachment"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_service_attachment"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ServiceAttachment_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/sharedvpchostproject/zz_controller.go b/internal/controller/compute/sharedvpchostproject/zz_controller.go
index a6b04b3e6..92ce02da1 100755
--- a/internal/controller/compute/sharedvpchostproject/zz_controller.go
+++ b/internal/controller/compute/sharedvpchostproject/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.SharedVPCHostProject_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SharedVPCHostProject_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SharedVPCHostProject_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_shared_vpc_host_project"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_shared_vpc_host_project"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.SharedVPCHostProject_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/sharedvpcserviceproject/zz_controller.go b/internal/controller/compute/sharedvpcserviceproject/zz_controller.go
index 49d214a5b..9d03e8ba7 100755
--- a/internal/controller/compute/sharedvpcserviceproject/zz_controller.go
+++ b/internal/controller/compute/sharedvpcserviceproject/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.SharedVPCServiceProject_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SharedVPCServiceProject_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SharedVPCServiceProject_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_shared_vpc_service_project"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_shared_vpc_service_project"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.SharedVPCServiceProject_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/snapshot/zz_controller.go b/internal/controller/compute/snapshot/zz_controller.go
index bfe4d88f9..c036e3ae8 100755
--- a/internal/controller/compute/snapshot/zz_controller.go
+++ b/internal/controller/compute/snapshot/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Snapshot_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Snapshot_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Snapshot_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_snapshot"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_snapshot"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Snapshot_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/snapshotiammember/zz_controller.go b/internal/controller/compute/snapshotiammember/zz_controller.go
index a4f7cfa01..a04688e3e 100755
--- a/internal/controller/compute/snapshotiammember/zz_controller.go
+++ b/internal/controller/compute/snapshotiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.SnapshotIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SnapshotIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SnapshotIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_snapshot_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_snapshot_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.SnapshotIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/sslcertificate/zz_controller.go b/internal/controller/compute/sslcertificate/zz_controller.go
index f6eafe2de..bd33014f5 100755
--- a/internal/controller/compute/sslcertificate/zz_controller.go
+++ b/internal/controller/compute/sslcertificate/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.SSLCertificate_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SSLCertificate_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SSLCertificate_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_ssl_certificate"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_ssl_certificate"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.SSLCertificate_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/sslpolicy/zz_controller.go b/internal/controller/compute/sslpolicy/zz_controller.go
index 7687f025c..bb9294cea 100755
--- a/internal/controller/compute/sslpolicy/zz_controller.go
+++ b/internal/controller/compute/sslpolicy/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.SSLPolicy_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SSLPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SSLPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_ssl_policy"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_ssl_policy"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.SSLPolicy_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/subnetwork/zz_controller.go b/internal/controller/compute/subnetwork/zz_controller.go
index bd1186695..4c2f88474 100755
--- a/internal/controller/compute/subnetwork/zz_controller.go
+++ b/internal/controller/compute/subnetwork/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Subnetwork_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Subnetwork_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Subnetwork_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_subnetwork"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_subnetwork"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Subnetwork_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/subnetworkiammember/zz_controller.go b/internal/controller/compute/subnetworkiammember/zz_controller.go
index 67d2bd8b1..8f7512436 100755
--- a/internal/controller/compute/subnetworkiammember/zz_controller.go
+++ b/internal/controller/compute/subnetworkiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.SubnetworkIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SubnetworkIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SubnetworkIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_subnetwork_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_subnetwork_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.SubnetworkIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/targetgrpcproxy/zz_controller.go b/internal/controller/compute/targetgrpcproxy/zz_controller.go
index e4eff4503..85c4c7972 100755
--- a/internal/controller/compute/targetgrpcproxy/zz_controller.go
+++ b/internal/controller/compute/targetgrpcproxy/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.TargetGRPCProxy_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TargetGRPCProxy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TargetGRPCProxy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_target_grpc_proxy"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_target_grpc_proxy"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.TargetGRPCProxy_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/targethttpproxy/zz_controller.go b/internal/controller/compute/targethttpproxy/zz_controller.go
index a5f14376a..4091ecd82 100755
--- a/internal/controller/compute/targethttpproxy/zz_controller.go
+++ b/internal/controller/compute/targethttpproxy/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.TargetHTTPProxy_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TargetHTTPProxy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TargetHTTPProxy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_target_http_proxy"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_target_http_proxy"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.TargetHTTPProxy_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/targethttpsproxy/zz_controller.go b/internal/controller/compute/targethttpsproxy/zz_controller.go
index 96992fb27..1b8de7f3d 100755
--- a/internal/controller/compute/targethttpsproxy/zz_controller.go
+++ b/internal/controller/compute/targethttpsproxy/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.TargetHTTPSProxy_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TargetHTTPSProxy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TargetHTTPSProxy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_target_https_proxy"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_target_https_proxy"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.TargetHTTPSProxy_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/targetinstance/zz_controller.go b/internal/controller/compute/targetinstance/zz_controller.go
index 11faca5bb..c24788d49 100755
--- a/internal/controller/compute/targetinstance/zz_controller.go
+++ b/internal/controller/compute/targetinstance/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.TargetInstance_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TargetInstance_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TargetInstance_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_target_instance"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_target_instance"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.TargetInstance_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/targetpool/zz_controller.go b/internal/controller/compute/targetpool/zz_controller.go
index d6af9cb84..0c72f2f4d 100755
--- a/internal/controller/compute/targetpool/zz_controller.go
+++ b/internal/controller/compute/targetpool/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.TargetPool_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TargetPool_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TargetPool_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_target_pool"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_target_pool"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.TargetPool_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/targetsslproxy/zz_controller.go b/internal/controller/compute/targetsslproxy/zz_controller.go
index 5c9b1d1c3..2d7198ff5 100755
--- a/internal/controller/compute/targetsslproxy/zz_controller.go
+++ b/internal/controller/compute/targetsslproxy/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.TargetSSLProxy_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TargetSSLProxy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TargetSSLProxy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_target_ssl_proxy"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_target_ssl_proxy"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.TargetSSLProxy_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/targettcpproxy/zz_controller.go b/internal/controller/compute/targettcpproxy/zz_controller.go
index 574d20302..0028f7b22 100755
--- a/internal/controller/compute/targettcpproxy/zz_controller.go
+++ b/internal/controller/compute/targettcpproxy/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.TargetTCPProxy_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TargetTCPProxy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TargetTCPProxy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_target_tcp_proxy"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_target_tcp_proxy"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.TargetTCPProxy_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/urlmap/zz_controller.go b/internal/controller/compute/urlmap/zz_controller.go
index 76e068879..77489c172 100755
--- a/internal/controller/compute/urlmap/zz_controller.go
+++ b/internal/controller/compute/urlmap/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.URLMap_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.URLMap_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.URLMap_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_url_map"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_url_map"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.URLMap_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/vpngateway/zz_controller.go b/internal/controller/compute/vpngateway/zz_controller.go
index 0acab2d08..d8f019c73 100755
--- a/internal/controller/compute/vpngateway/zz_controller.go
+++ b/internal/controller/compute/vpngateway/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.VPNGateway_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.VPNGateway_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.VPNGateway_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_vpn_gateway"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_vpn_gateway"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.VPNGateway_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/compute/vpntunnel/zz_controller.go b/internal/controller/compute/vpntunnel/zz_controller.go
index 7faef6d3f..b8d77b2b4 100755
--- a/internal/controller/compute/vpntunnel/zz_controller.go
+++ b/internal/controller/compute/vpntunnel/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/compute/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.VPNTunnel_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.VPNTunnel_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.VPNTunnel_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_compute_vpn_tunnel"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_compute_vpn_tunnel"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.VPNTunnel_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/container/cluster/zz_controller.go b/internal/controller/container/cluster/zz_controller.go
index 0e5fb4bda..4501c86ce 100755
--- a/internal/controller/container/cluster/zz_controller.go
+++ b/internal/controller/container/cluster/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/container/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Cluster_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Cluster_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Cluster_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_container_cluster"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_container_cluster"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Cluster_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/container/nodepool/zz_controller.go b/internal/controller/container/nodepool/zz_controller.go
index 7bfe9909b..9d49adf66 100755
--- a/internal/controller/container/nodepool/zz_controller.go
+++ b/internal/controller/container/nodepool/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/container/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.NodePool_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.NodePool_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.NodePool_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_container_node_pool"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_container_node_pool"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.NodePool_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/container/registry/zz_controller.go b/internal/controller/container/registry/zz_controller.go
index 8b17eb8f5..d1eb456ec 100755
--- a/internal/controller/container/registry/zz_controller.go
+++ b/internal/controller/container/registry/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/container/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Registry_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Registry_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Registry_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_container_registry"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_container_registry"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Registry_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/containeranalysis/note/zz_controller.go b/internal/controller/containeranalysis/note/zz_controller.go
index 0074cbc92..722bc2144 100755
--- a/internal/controller/containeranalysis/note/zz_controller.go
+++ b/internal/controller/containeranalysis/note/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/containeranalysis/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Note_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Note_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Note_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_container_analysis_note"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_container_analysis_note"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Note_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/containeraws/cluster/zz_controller.go b/internal/controller/containeraws/cluster/zz_controller.go
index 212b6727a..2248cfa5a 100755
--- a/internal/controller/containeraws/cluster/zz_controller.go
+++ b/internal/controller/containeraws/cluster/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/containeraws/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Cluster_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Cluster_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Cluster_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_container_aws_cluster"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_container_aws_cluster"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Cluster_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/containeraws/nodepool/zz_controller.go b/internal/controller/containeraws/nodepool/zz_controller.go
index 8254676c8..95d7a9d0b 100755
--- a/internal/controller/containeraws/nodepool/zz_controller.go
+++ b/internal/controller/containeraws/nodepool/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/containeraws/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.NodePool_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.NodePool_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.NodePool_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_container_aws_node_pool"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_container_aws_node_pool"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.NodePool_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/containerazure/client/zz_controller.go b/internal/controller/containerazure/client/zz_controller.go
index 462ad914d..82d412301 100755
--- a/internal/controller/containerazure/client/zz_controller.go
+++ b/internal/controller/containerazure/client/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/containerazure/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Client_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Client_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Client_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_container_azure_client"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_container_azure_client"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Client_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/containerazure/cluster/zz_controller.go b/internal/controller/containerazure/cluster/zz_controller.go
index 9cae79943..f80d12d79 100755
--- a/internal/controller/containerazure/cluster/zz_controller.go
+++ b/internal/controller/containerazure/cluster/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/containerazure/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Cluster_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Cluster_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Cluster_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_container_azure_cluster"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_container_azure_cluster"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Cluster_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/containerazure/nodepool/zz_controller.go b/internal/controller/containerazure/nodepool/zz_controller.go
index 0d4dfb4c2..7cfb2f946 100755
--- a/internal/controller/containerazure/nodepool/zz_controller.go
+++ b/internal/controller/containerazure/nodepool/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/containerazure/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.NodePool_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.NodePool_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.NodePool_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_container_azure_node_pool"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_container_azure_node_pool"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.NodePool_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/datacatalog/entry/zz_controller.go b/internal/controller/datacatalog/entry/zz_controller.go
index 83dfbf18e..313569036 100755
--- a/internal/controller/datacatalog/entry/zz_controller.go
+++ b/internal/controller/datacatalog/entry/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/datacatalog/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Entry_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Entry_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Entry_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_data_catalog_entry"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_data_catalog_entry"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Entry_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/datacatalog/entrygroup/zz_controller.go b/internal/controller/datacatalog/entrygroup/zz_controller.go
index 898e3745c..f0d048da2 100755
--- a/internal/controller/datacatalog/entrygroup/zz_controller.go
+++ b/internal/controller/datacatalog/entrygroup/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/datacatalog/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.EntryGroup_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.EntryGroup_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.EntryGroup_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_data_catalog_entry_group"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_data_catalog_entry_group"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.EntryGroup_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/datacatalog/tag/zz_controller.go b/internal/controller/datacatalog/tag/zz_controller.go
index 4b1098ad6..82c1aa0ea 100755
--- a/internal/controller/datacatalog/tag/zz_controller.go
+++ b/internal/controller/datacatalog/tag/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/datacatalog/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Tag_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Tag_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Tag_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_data_catalog_tag"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_data_catalog_tag"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Tag_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/datacatalog/tagtemplate/zz_controller.go b/internal/controller/datacatalog/tagtemplate/zz_controller.go
index c12aba71a..12465484b 100755
--- a/internal/controller/datacatalog/tagtemplate/zz_controller.go
+++ b/internal/controller/datacatalog/tagtemplate/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/datacatalog/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.TagTemplate_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TagTemplate_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TagTemplate_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_data_catalog_tag_template"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_data_catalog_tag_template"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.TagTemplate_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/dataflow/job/zz_controller.go b/internal/controller/dataflow/job/zz_controller.go
index 07a620d61..c4e79daa7 100755
--- a/internal/controller/dataflow/job/zz_controller.go
+++ b/internal/controller/dataflow/job/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/dataflow/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Job_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Job_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Job_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_dataflow_job"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_dataflow_job"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Job_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/datafusion/instance/zz_controller.go b/internal/controller/datafusion/instance/zz_controller.go
index c436056ff..447c4364f 100755
--- a/internal/controller/datafusion/instance/zz_controller.go
+++ b/internal/controller/datafusion/instance/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/datafusion/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Instance_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Instance_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Instance_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_data_fusion_instance"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_data_fusion_instance"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Instance_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/datalossprevention/deidentifytemplate/zz_controller.go b/internal/controller/datalossprevention/deidentifytemplate/zz_controller.go
index be5f543a8..10cb0693b 100755
--- a/internal/controller/datalossprevention/deidentifytemplate/zz_controller.go
+++ b/internal/controller/datalossprevention/deidentifytemplate/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/datalossprevention/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.DeidentifyTemplate_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DeidentifyTemplate_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DeidentifyTemplate_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_data_loss_prevention_deidentify_template"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_data_loss_prevention_deidentify_template"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.DeidentifyTemplate_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/datalossprevention/inspecttemplate/zz_controller.go b/internal/controller/datalossprevention/inspecttemplate/zz_controller.go
index 2544b03e5..4e9247d73 100755
--- a/internal/controller/datalossprevention/inspecttemplate/zz_controller.go
+++ b/internal/controller/datalossprevention/inspecttemplate/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/datalossprevention/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.InspectTemplate_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InspectTemplate_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InspectTemplate_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_data_loss_prevention_inspect_template"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_data_loss_prevention_inspect_template"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.InspectTemplate_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/datalossprevention/jobtrigger/zz_controller.go b/internal/controller/datalossprevention/jobtrigger/zz_controller.go
index 91bdf6263..40535bf58 100755
--- a/internal/controller/datalossprevention/jobtrigger/zz_controller.go
+++ b/internal/controller/datalossprevention/jobtrigger/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/datalossprevention/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.JobTrigger_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.JobTrigger_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.JobTrigger_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_data_loss_prevention_job_trigger"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_data_loss_prevention_job_trigger"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.JobTrigger_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/datalossprevention/storedinfotype/zz_controller.go b/internal/controller/datalossprevention/storedinfotype/zz_controller.go
index 2e504bcef..dd175b1b2 100755
--- a/internal/controller/datalossprevention/storedinfotype/zz_controller.go
+++ b/internal/controller/datalossprevention/storedinfotype/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/datalossprevention/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.StoredInfoType_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.StoredInfoType_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.StoredInfoType_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_data_loss_prevention_stored_info_type"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_data_loss_prevention_stored_info_type"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.StoredInfoType_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/dataplex/asset/zz_controller.go b/internal/controller/dataplex/asset/zz_controller.go
index 7c62b3ec5..d1a8d0252 100755
--- a/internal/controller/dataplex/asset/zz_controller.go
+++ b/internal/controller/dataplex/asset/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/dataplex/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Asset_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Asset_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Asset_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_dataplex_asset"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_dataplex_asset"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Asset_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/dataplex/lake/zz_controller.go b/internal/controller/dataplex/lake/zz_controller.go
index 545c1fcc9..ef1f8ce39 100755
--- a/internal/controller/dataplex/lake/zz_controller.go
+++ b/internal/controller/dataplex/lake/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/dataplex/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Lake_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Lake_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Lake_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_dataplex_lake"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_dataplex_lake"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Lake_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/dataplex/zone/zz_controller.go b/internal/controller/dataplex/zone/zz_controller.go
index e26c86d4e..f1cbb38a3 100755
--- a/internal/controller/dataplex/zone/zz_controller.go
+++ b/internal/controller/dataplex/zone/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/dataplex/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Zone_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Zone_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Zone_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_dataplex_zone"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_dataplex_zone"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Zone_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/dataproc/autoscalingpolicy/zz_controller.go b/internal/controller/dataproc/autoscalingpolicy/zz_controller.go
index 3c3f5d0cc..893bdbcd3 100755
--- a/internal/controller/dataproc/autoscalingpolicy/zz_controller.go
+++ b/internal/controller/dataproc/autoscalingpolicy/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/dataproc/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.AutoscalingPolicy_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AutoscalingPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AutoscalingPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_dataproc_autoscaling_policy"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_dataproc_autoscaling_policy"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.AutoscalingPolicy_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/dataproc/cluster/zz_controller.go b/internal/controller/dataproc/cluster/zz_controller.go
index 1d9d6cb44..5696b62c9 100755
--- a/internal/controller/dataproc/cluster/zz_controller.go
+++ b/internal/controller/dataproc/cluster/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/dataproc/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Cluster_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Cluster_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Cluster_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_dataproc_cluster"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_dataproc_cluster"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Cluster_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/dataproc/job/zz_controller.go b/internal/controller/dataproc/job/zz_controller.go
index 3b622af88..85c93ed0c 100755
--- a/internal/controller/dataproc/job/zz_controller.go
+++ b/internal/controller/dataproc/job/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/dataproc/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Job_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Job_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Job_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_dataproc_job"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_dataproc_job"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Job_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/dataproc/metastoreservice/zz_controller.go b/internal/controller/dataproc/metastoreservice/zz_controller.go
index 265a6a70a..214d5b96d 100755
--- a/internal/controller/dataproc/metastoreservice/zz_controller.go
+++ b/internal/controller/dataproc/metastoreservice/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/dataproc/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.MetastoreService_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.MetastoreService_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.MetastoreService_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_dataproc_metastore_service"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_dataproc_metastore_service"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.MetastoreService_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/dataproc/workflowtemplate/zz_controller.go b/internal/controller/dataproc/workflowtemplate/zz_controller.go
index 049fb66ac..0fa2fca0c 100755
--- a/internal/controller/dataproc/workflowtemplate/zz_controller.go
+++ b/internal/controller/dataproc/workflowtemplate/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/dataproc/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.WorkflowTemplate_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.WorkflowTemplate_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.WorkflowTemplate_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_dataproc_workflow_template"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_dataproc_workflow_template"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.WorkflowTemplate_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/datastore/index/zz_controller.go b/internal/controller/datastore/index/zz_controller.go
index f68b184bd..b60a0a5cf 100755
--- a/internal/controller/datastore/index/zz_controller.go
+++ b/internal/controller/datastore/index/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/datastore/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Index_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Index_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Index_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_datastore_index"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_datastore_index"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Index_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/datastream/connectionprofile/zz_controller.go b/internal/controller/datastream/connectionprofile/zz_controller.go
index 63ea06b08..9d6cb1fc8 100755
--- a/internal/controller/datastream/connectionprofile/zz_controller.go
+++ b/internal/controller/datastream/connectionprofile/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/datastream/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ConnectionProfile_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ConnectionProfile_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ConnectionProfile_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_datastream_connection_profile"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_datastream_connection_profile"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ConnectionProfile_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/datastream/privateconnection/zz_controller.go b/internal/controller/datastream/privateconnection/zz_controller.go
index 5c90e3bd8..f5f886bf4 100755
--- a/internal/controller/datastream/privateconnection/zz_controller.go
+++ b/internal/controller/datastream/privateconnection/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/datastream/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.PrivateConnection_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.PrivateConnection_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.PrivateConnection_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_datastream_private_connection"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_datastream_private_connection"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.PrivateConnection_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/dialogflowcx/agent/zz_controller.go b/internal/controller/dialogflowcx/agent/zz_controller.go
index 2de090855..7ee3ad6c9 100755
--- a/internal/controller/dialogflowcx/agent/zz_controller.go
+++ b/internal/controller/dialogflowcx/agent/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/dialogflowcx/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Agent_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Agent_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Agent_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_dialogflow_cx_agent"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_dialogflow_cx_agent"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Agent_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/dialogflowcx/entitytype/zz_controller.go b/internal/controller/dialogflowcx/entitytype/zz_controller.go
index ec2a8cd7b..7720edfee 100755
--- a/internal/controller/dialogflowcx/entitytype/zz_controller.go
+++ b/internal/controller/dialogflowcx/entitytype/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/dialogflowcx/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.EntityType_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.EntityType_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.EntityType_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_dialogflow_cx_entity_type"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_dialogflow_cx_entity_type"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.EntityType_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/dialogflowcx/environment/zz_controller.go b/internal/controller/dialogflowcx/environment/zz_controller.go
index 9b7fa0327..c941629d5 100755
--- a/internal/controller/dialogflowcx/environment/zz_controller.go
+++ b/internal/controller/dialogflowcx/environment/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/dialogflowcx/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Environment_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Environment_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Environment_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_dialogflow_cx_environment"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_dialogflow_cx_environment"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Environment_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/dialogflowcx/flow/zz_controller.go b/internal/controller/dialogflowcx/flow/zz_controller.go
index 5c05c454e..8ea03172f 100755
--- a/internal/controller/dialogflowcx/flow/zz_controller.go
+++ b/internal/controller/dialogflowcx/flow/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/dialogflowcx/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Flow_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Flow_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Flow_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_dialogflow_cx_flow"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_dialogflow_cx_flow"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Flow_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/dialogflowcx/intent/zz_controller.go b/internal/controller/dialogflowcx/intent/zz_controller.go
index f7d2cc952..5e1ebf9ad 100755
--- a/internal/controller/dialogflowcx/intent/zz_controller.go
+++ b/internal/controller/dialogflowcx/intent/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/dialogflowcx/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Intent_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Intent_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Intent_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_dialogflow_cx_intent"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_dialogflow_cx_intent"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Intent_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/dialogflowcx/page/zz_controller.go b/internal/controller/dialogflowcx/page/zz_controller.go
index b3960298b..0459c8536 100755
--- a/internal/controller/dialogflowcx/page/zz_controller.go
+++ b/internal/controller/dialogflowcx/page/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/dialogflowcx/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Page_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Page_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Page_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_dialogflow_cx_page"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_dialogflow_cx_page"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Page_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/dialogflowcx/version/zz_controller.go b/internal/controller/dialogflowcx/version/zz_controller.go
index 8fb347d7a..82fafd4f3 100755
--- a/internal/controller/dialogflowcx/version/zz_controller.go
+++ b/internal/controller/dialogflowcx/version/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/dialogflowcx/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Version_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Version_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Version_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_dialogflow_cx_version"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_dialogflow_cx_version"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Version_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/dialogflowcx/webhook/zz_controller.go b/internal/controller/dialogflowcx/webhook/zz_controller.go
index 097f0ec66..7d2e5553b 100755
--- a/internal/controller/dialogflowcx/webhook/zz_controller.go
+++ b/internal/controller/dialogflowcx/webhook/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/dialogflowcx/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Webhook_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Webhook_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Webhook_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_dialogflow_cx_webhook"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_dialogflow_cx_webhook"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Webhook_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/dns/managedzone/zz_controller.go b/internal/controller/dns/managedzone/zz_controller.go
index 34a37e7fd..78f8604b8 100755
--- a/internal/controller/dns/managedzone/zz_controller.go
+++ b/internal/controller/dns/managedzone/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/dns/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ManagedZone_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ManagedZone_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ManagedZone_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_dns_managed_zone"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_dns_managed_zone"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ManagedZone_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/dns/managedzoneiammember/zz_controller.go b/internal/controller/dns/managedzoneiammember/zz_controller.go
index 340a7b893..2c21a75d1 100755
--- a/internal/controller/dns/managedzoneiammember/zz_controller.go
+++ b/internal/controller/dns/managedzoneiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/dns/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ManagedZoneIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ManagedZoneIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ManagedZoneIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_dns_managed_zone_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_dns_managed_zone_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ManagedZoneIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/dns/policy/zz_controller.go b/internal/controller/dns/policy/zz_controller.go
index 225758a98..1b2faf0ae 100755
--- a/internal/controller/dns/policy/zz_controller.go
+++ b/internal/controller/dns/policy/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/dns/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Policy_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Policy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Policy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_dns_policy"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_dns_policy"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Policy_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/dns/recordset/zz_controller.go b/internal/controller/dns/recordset/zz_controller.go
index 4a57e7467..ce8b3ea29 100755
--- a/internal/controller/dns/recordset/zz_controller.go
+++ b/internal/controller/dns/recordset/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/dns/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.RecordSet_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RecordSet_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RecordSet_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_dns_record_set"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_dns_record_set"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.RecordSet_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/documentai/processor/zz_controller.go b/internal/controller/documentai/processor/zz_controller.go
index 1f44f5b4e..b618c5aa7 100755
--- a/internal/controller/documentai/processor/zz_controller.go
+++ b/internal/controller/documentai/processor/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/documentai/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Processor_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Processor_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Processor_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_document_ai_processor"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_document_ai_processor"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Processor_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/essentialcontacts/contact/zz_controller.go b/internal/controller/essentialcontacts/contact/zz_controller.go
index 227616d95..8d276d890 100755
--- a/internal/controller/essentialcontacts/contact/zz_controller.go
+++ b/internal/controller/essentialcontacts/contact/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/essentialcontacts/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Contact_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Contact_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Contact_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_essential_contacts_contact"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_essential_contacts_contact"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Contact_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/eventarc/channel/zz_controller.go b/internal/controller/eventarc/channel/zz_controller.go
index dc86a6b8d..b3d4a7d48 100755
--- a/internal/controller/eventarc/channel/zz_controller.go
+++ b/internal/controller/eventarc/channel/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/eventarc/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Channel_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Channel_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Channel_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_eventarc_channel"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_eventarc_channel"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Channel_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/eventarc/googlechannelconfig/zz_controller.go b/internal/controller/eventarc/googlechannelconfig/zz_controller.go
index 6b1a14a07..a4352b7a3 100755
--- a/internal/controller/eventarc/googlechannelconfig/zz_controller.go
+++ b/internal/controller/eventarc/googlechannelconfig/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/eventarc/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.GoogleChannelConfig_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.GoogleChannelConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.GoogleChannelConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_eventarc_google_channel_config"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_eventarc_google_channel_config"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.GoogleChannelConfig_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/eventarc/trigger/zz_controller.go b/internal/controller/eventarc/trigger/zz_controller.go
index 4baf2af92..4beeaad7a 100755
--- a/internal/controller/eventarc/trigger/zz_controller.go
+++ b/internal/controller/eventarc/trigger/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/eventarc/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Trigger_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Trigger_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Trigger_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_eventarc_trigger"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_eventarc_trigger"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Trigger_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/filestore/backup/zz_controller.go b/internal/controller/filestore/backup/zz_controller.go
index eecf49426..d8ecd8326 100755
--- a/internal/controller/filestore/backup/zz_controller.go
+++ b/internal/controller/filestore/backup/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/filestore/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Backup_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Backup_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Backup_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_filestore_backup"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_filestore_backup"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Backup_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/filestore/instance/zz_controller.go b/internal/controller/filestore/instance/zz_controller.go
index 79f56b034..38e9760ae 100755
--- a/internal/controller/filestore/instance/zz_controller.go
+++ b/internal/controller/filestore/instance/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/filestore/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Instance_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Instance_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Instance_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_filestore_instance"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_filestore_instance"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Instance_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/filestore/snapshot/zz_controller.go b/internal/controller/filestore/snapshot/zz_controller.go
index d2e873082..bb42201e3 100755
--- a/internal/controller/filestore/snapshot/zz_controller.go
+++ b/internal/controller/filestore/snapshot/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/filestore/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Snapshot_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Snapshot_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Snapshot_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_filestore_snapshot"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_filestore_snapshot"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Snapshot_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/firebaserules/release/zz_controller.go b/internal/controller/firebaserules/release/zz_controller.go
index 5e0adef84..372605014 100755
--- a/internal/controller/firebaserules/release/zz_controller.go
+++ b/internal/controller/firebaserules/release/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/firebaserules/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Release_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Release_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Release_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_firebaserules_release"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_firebaserules_release"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Release_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/firebaserules/ruleset/zz_controller.go b/internal/controller/firebaserules/ruleset/zz_controller.go
index ff59a397f..e98ab82eb 100755
--- a/internal/controller/firebaserules/ruleset/zz_controller.go
+++ b/internal/controller/firebaserules/ruleset/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/firebaserules/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Ruleset_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Ruleset_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Ruleset_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_firebaserules_ruleset"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_firebaserules_ruleset"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Ruleset_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/gke/backupbackupplan/zz_controller.go b/internal/controller/gke/backupbackupplan/zz_controller.go
index e82165698..17e050bd4 100755
--- a/internal/controller/gke/backupbackupplan/zz_controller.go
+++ b/internal/controller/gke/backupbackupplan/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/gke/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.BackupBackupPlan_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.BackupBackupPlan_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.BackupBackupPlan_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_gke_backup_backup_plan"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_gke_backup_backup_plan"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.BackupBackupPlan_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/gkehub/membership/zz_controller.go b/internal/controller/gkehub/membership/zz_controller.go
index 895636e68..a870c1fe8 100755
--- a/internal/controller/gkehub/membership/zz_controller.go
+++ b/internal/controller/gkehub/membership/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/gkehub/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Membership_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Membership_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Membership_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_gke_hub_membership"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_gke_hub_membership"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Membership_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/gkehub/membershipiammember/zz_controller.go b/internal/controller/gkehub/membershipiammember/zz_controller.go
index 054a5ecc4..4e150d1dd 100755
--- a/internal/controller/gkehub/membershipiammember/zz_controller.go
+++ b/internal/controller/gkehub/membershipiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/gkehub/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.MembershipIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.MembershipIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.MembershipIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_gke_hub_membership_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_gke_hub_membership_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.MembershipIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/healthcare/consentstore/zz_controller.go b/internal/controller/healthcare/consentstore/zz_controller.go
index c98d579d8..6945a34cf 100755
--- a/internal/controller/healthcare/consentstore/zz_controller.go
+++ b/internal/controller/healthcare/consentstore/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/healthcare/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ConsentStore_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ConsentStore_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ConsentStore_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_healthcare_consent_store"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_healthcare_consent_store"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ConsentStore_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/healthcare/dataset/zz_controller.go b/internal/controller/healthcare/dataset/zz_controller.go
index 2f03d9a02..0fef24c05 100755
--- a/internal/controller/healthcare/dataset/zz_controller.go
+++ b/internal/controller/healthcare/dataset/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/healthcare/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Dataset_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Dataset_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Dataset_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_healthcare_dataset"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_healthcare_dataset"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Dataset_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/healthcare/datasetiammember/zz_controller.go b/internal/controller/healthcare/datasetiammember/zz_controller.go
index 99cbc4c58..7f1aa59b9 100755
--- a/internal/controller/healthcare/datasetiammember/zz_controller.go
+++ b/internal/controller/healthcare/datasetiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/healthcare/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.DatasetIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DatasetIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DatasetIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_healthcare_dataset_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_healthcare_dataset_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.DatasetIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/iam/workloadidentitypool/zz_controller.go b/internal/controller/iam/workloadidentitypool/zz_controller.go
index e601fd25c..d4e21caaf 100755
--- a/internal/controller/iam/workloadidentitypool/zz_controller.go
+++ b/internal/controller/iam/workloadidentitypool/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/iam/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.WorkloadIdentityPool_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.WorkloadIdentityPool_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.WorkloadIdentityPool_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_iam_workload_identity_pool"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_iam_workload_identity_pool"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.WorkloadIdentityPool_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/iam/workloadidentitypoolprovider/zz_controller.go b/internal/controller/iam/workloadidentitypoolprovider/zz_controller.go
index 8567e3d1a..f57667972 100755
--- a/internal/controller/iam/workloadidentitypoolprovider/zz_controller.go
+++ b/internal/controller/iam/workloadidentitypoolprovider/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/iam/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.WorkloadIdentityPoolProvider_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.WorkloadIdentityPoolProvider_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.WorkloadIdentityPoolProvider_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_iam_workload_identity_pool_provider"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_iam_workload_identity_pool_provider"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.WorkloadIdentityPoolProvider_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/iap/appengineserviceiammember/zz_controller.go b/internal/controller/iap/appengineserviceiammember/zz_controller.go
index 73e42617a..c8c4ca361 100755
--- a/internal/controller/iap/appengineserviceiammember/zz_controller.go
+++ b/internal/controller/iap/appengineserviceiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/iap/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.AppEngineServiceIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AppEngineServiceIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AppEngineServiceIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_iap_app_engine_service_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_iap_app_engine_service_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.AppEngineServiceIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/iap/appengineversioniammember/zz_controller.go b/internal/controller/iap/appengineversioniammember/zz_controller.go
index da2c61914..7d8f23bdd 100755
--- a/internal/controller/iap/appengineversioniammember/zz_controller.go
+++ b/internal/controller/iap/appengineversioniammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/iap/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.AppEngineVersionIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AppEngineVersionIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AppEngineVersionIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_iap_app_engine_version_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_iap_app_engine_version_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.AppEngineVersionIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/iap/tunneliammember/zz_controller.go b/internal/controller/iap/tunneliammember/zz_controller.go
index 4449b0b77..af9747c50 100755
--- a/internal/controller/iap/tunneliammember/zz_controller.go
+++ b/internal/controller/iap/tunneliammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/iap/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.TunnelIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TunnelIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TunnelIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_iap_tunnel_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_iap_tunnel_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.TunnelIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/iap/webbackendserviceiammember/zz_controller.go b/internal/controller/iap/webbackendserviceiammember/zz_controller.go
index baded603a..35081b566 100755
--- a/internal/controller/iap/webbackendserviceiammember/zz_controller.go
+++ b/internal/controller/iap/webbackendserviceiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/iap/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.WebBackendServiceIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.WebBackendServiceIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.WebBackendServiceIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_iap_web_backend_service_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_iap_web_backend_service_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.WebBackendServiceIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/iap/webiammember/zz_controller.go b/internal/controller/iap/webiammember/zz_controller.go
index ae21dc8c4..13f04423f 100755
--- a/internal/controller/iap/webiammember/zz_controller.go
+++ b/internal/controller/iap/webiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/iap/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.WebIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.WebIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.WebIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_iap_web_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_iap_web_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.WebIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/iap/webtypeappengineiammember/zz_controller.go b/internal/controller/iap/webtypeappengineiammember/zz_controller.go
index e3316287a..a6ec8f9c8 100755
--- a/internal/controller/iap/webtypeappengineiammember/zz_controller.go
+++ b/internal/controller/iap/webtypeappengineiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/iap/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.WebTypeAppEngineIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.WebTypeAppEngineIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.WebTypeAppEngineIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_iap_web_type_app_engine_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_iap_web_type_app_engine_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.WebTypeAppEngineIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/iap/webtypecomputeiammember/zz_controller.go b/internal/controller/iap/webtypecomputeiammember/zz_controller.go
index 1dc42e980..be1977a1a 100755
--- a/internal/controller/iap/webtypecomputeiammember/zz_controller.go
+++ b/internal/controller/iap/webtypecomputeiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/iap/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.WebTypeComputeIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.WebTypeComputeIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.WebTypeComputeIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_iap_web_type_compute_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_iap_web_type_compute_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.WebTypeComputeIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/identityplatform/defaultsupportedidpconfig/zz_controller.go b/internal/controller/identityplatform/defaultsupportedidpconfig/zz_controller.go
index d7853b1a1..b8819e547 100755
--- a/internal/controller/identityplatform/defaultsupportedidpconfig/zz_controller.go
+++ b/internal/controller/identityplatform/defaultsupportedidpconfig/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/identityplatform/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.DefaultSupportedIdPConfig_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DefaultSupportedIdPConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DefaultSupportedIdPConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_identity_platform_default_supported_idp_config"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_identity_platform_default_supported_idp_config"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.DefaultSupportedIdPConfig_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/identityplatform/inboundsamlconfig/zz_controller.go b/internal/controller/identityplatform/inboundsamlconfig/zz_controller.go
index ba2fc822e..f21572c0d 100755
--- a/internal/controller/identityplatform/inboundsamlconfig/zz_controller.go
+++ b/internal/controller/identityplatform/inboundsamlconfig/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/identityplatform/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.InboundSAMLConfig_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InboundSAMLConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InboundSAMLConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_identity_platform_inbound_saml_config"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_identity_platform_inbound_saml_config"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.InboundSAMLConfig_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/identityplatform/oauthidpconfig/zz_controller.go b/internal/controller/identityplatform/oauthidpconfig/zz_controller.go
index a7fef2c1c..9260e5ebb 100755
--- a/internal/controller/identityplatform/oauthidpconfig/zz_controller.go
+++ b/internal/controller/identityplatform/oauthidpconfig/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/identityplatform/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.OAuthIdPConfig_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.OAuthIdPConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.OAuthIdPConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_identity_platform_oauth_idp_config"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_identity_platform_oauth_idp_config"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.OAuthIdPConfig_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/identityplatform/projectdefaultconfig/zz_controller.go b/internal/controller/identityplatform/projectdefaultconfig/zz_controller.go
index 4db978498..19c9fe656 100755
--- a/internal/controller/identityplatform/projectdefaultconfig/zz_controller.go
+++ b/internal/controller/identityplatform/projectdefaultconfig/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/identityplatform/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ProjectDefaultConfig_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ProjectDefaultConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ProjectDefaultConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_identity_platform_project_default_config"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_identity_platform_project_default_config"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ProjectDefaultConfig_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/identityplatform/tenant/zz_controller.go b/internal/controller/identityplatform/tenant/zz_controller.go
index 20f9d2da4..0f1d5bb1f 100755
--- a/internal/controller/identityplatform/tenant/zz_controller.go
+++ b/internal/controller/identityplatform/tenant/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/identityplatform/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Tenant_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Tenant_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Tenant_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_identity_platform_tenant"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_identity_platform_tenant"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Tenant_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/identityplatform/tenantdefaultsupportedidpconfig/zz_controller.go b/internal/controller/identityplatform/tenantdefaultsupportedidpconfig/zz_controller.go
index 7cb103b38..56fd643da 100755
--- a/internal/controller/identityplatform/tenantdefaultsupportedidpconfig/zz_controller.go
+++ b/internal/controller/identityplatform/tenantdefaultsupportedidpconfig/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/identityplatform/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.TenantDefaultSupportedIdPConfig_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TenantDefaultSupportedIdPConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TenantDefaultSupportedIdPConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_identity_platform_tenant_default_supported_idp_config"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_identity_platform_tenant_default_supported_idp_config"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.TenantDefaultSupportedIdPConfig_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/identityplatform/tenantinboundsamlconfig/zz_controller.go b/internal/controller/identityplatform/tenantinboundsamlconfig/zz_controller.go
index 1e2738997..3ae1cd314 100755
--- a/internal/controller/identityplatform/tenantinboundsamlconfig/zz_controller.go
+++ b/internal/controller/identityplatform/tenantinboundsamlconfig/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/identityplatform/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.TenantInboundSAMLConfig_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TenantInboundSAMLConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TenantInboundSAMLConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_identity_platform_tenant_inbound_saml_config"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_identity_platform_tenant_inbound_saml_config"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.TenantInboundSAMLConfig_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/identityplatform/tenantoauthidpconfig/zz_controller.go b/internal/controller/identityplatform/tenantoauthidpconfig/zz_controller.go
index 1a792db1c..eef4c4e6c 100755
--- a/internal/controller/identityplatform/tenantoauthidpconfig/zz_controller.go
+++ b/internal/controller/identityplatform/tenantoauthidpconfig/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/identityplatform/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.TenantOAuthIdPConfig_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TenantOAuthIdPConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TenantOAuthIdPConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_identity_platform_tenant_oauth_idp_config"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_identity_platform_tenant_oauth_idp_config"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.TenantOAuthIdPConfig_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/kms/cryptokey/zz_controller.go b/internal/controller/kms/cryptokey/zz_controller.go
index 4812da59d..d62777d0d 100755
--- a/internal/controller/kms/cryptokey/zz_controller.go
+++ b/internal/controller/kms/cryptokey/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/kms/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.CryptoKey_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.CryptoKey_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.CryptoKey_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_kms_crypto_key"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_kms_crypto_key"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.CryptoKey_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/kms/cryptokeyiammember/zz_controller.go b/internal/controller/kms/cryptokeyiammember/zz_controller.go
index 04ab2f68b..81979132d 100755
--- a/internal/controller/kms/cryptokeyiammember/zz_controller.go
+++ b/internal/controller/kms/cryptokeyiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/kms/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.CryptoKeyIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.CryptoKeyIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.CryptoKeyIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_kms_crypto_key_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_kms_crypto_key_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.CryptoKeyIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/kms/cryptokeyversion/zz_controller.go b/internal/controller/kms/cryptokeyversion/zz_controller.go
index a617581ba..91628375b 100755
--- a/internal/controller/kms/cryptokeyversion/zz_controller.go
+++ b/internal/controller/kms/cryptokeyversion/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/kms/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.CryptoKeyVersion_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.CryptoKeyVersion_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.CryptoKeyVersion_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_kms_crypto_key_version"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_kms_crypto_key_version"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.CryptoKeyVersion_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/kms/keyring/zz_controller.go b/internal/controller/kms/keyring/zz_controller.go
index 47396e7af..9c37965a7 100755
--- a/internal/controller/kms/keyring/zz_controller.go
+++ b/internal/controller/kms/keyring/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/kms/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.KeyRing_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.KeyRing_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.KeyRing_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_kms_key_ring"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_kms_key_ring"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.KeyRing_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/kms/keyringiammember/zz_controller.go b/internal/controller/kms/keyringiammember/zz_controller.go
index 4df30d2cd..35ff8c317 100755
--- a/internal/controller/kms/keyringiammember/zz_controller.go
+++ b/internal/controller/kms/keyringiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/kms/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.KeyRingIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.KeyRingIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.KeyRingIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_kms_key_ring_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_kms_key_ring_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.KeyRingIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/kms/keyringimportjob/zz_controller.go b/internal/controller/kms/keyringimportjob/zz_controller.go
index 71b775383..1f131465d 100755
--- a/internal/controller/kms/keyringimportjob/zz_controller.go
+++ b/internal/controller/kms/keyringimportjob/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/kms/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.KeyRingImportJob_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.KeyRingImportJob_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.KeyRingImportJob_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_kms_key_ring_import_job"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_kms_key_ring_import_job"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.KeyRingImportJob_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/kms/secretciphertext/zz_controller.go b/internal/controller/kms/secretciphertext/zz_controller.go
index 51afd16ca..6acf527c7 100755
--- a/internal/controller/kms/secretciphertext/zz_controller.go
+++ b/internal/controller/kms/secretciphertext/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/kms/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.SecretCiphertext_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SecretCiphertext_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SecretCiphertext_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_kms_secret_ciphertext"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_kms_secret_ciphertext"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.SecretCiphertext_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/logging/folderbucketconfig/zz_controller.go b/internal/controller/logging/folderbucketconfig/zz_controller.go
index 445a1820f..68826c4a3 100755
--- a/internal/controller/logging/folderbucketconfig/zz_controller.go
+++ b/internal/controller/logging/folderbucketconfig/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/logging/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.FolderBucketConfig_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.FolderBucketConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.FolderBucketConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_logging_folder_bucket_config"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_logging_folder_bucket_config"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.FolderBucketConfig_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/logging/folderexclusion/zz_controller.go b/internal/controller/logging/folderexclusion/zz_controller.go
index 64bbaade1..650cc3280 100755
--- a/internal/controller/logging/folderexclusion/zz_controller.go
+++ b/internal/controller/logging/folderexclusion/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/logging/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.FolderExclusion_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.FolderExclusion_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.FolderExclusion_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_logging_folder_exclusion"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_logging_folder_exclusion"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.FolderExclusion_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/logging/foldersink/zz_controller.go b/internal/controller/logging/foldersink/zz_controller.go
index 7b7d5cbe1..7d6680603 100755
--- a/internal/controller/logging/foldersink/zz_controller.go
+++ b/internal/controller/logging/foldersink/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/logging/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.FolderSink_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.FolderSink_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.FolderSink_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_logging_folder_sink"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_logging_folder_sink"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.FolderSink_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/logging/logview/zz_controller.go b/internal/controller/logging/logview/zz_controller.go
index 976cdc7e6..4f247c24c 100755
--- a/internal/controller/logging/logview/zz_controller.go
+++ b/internal/controller/logging/logview/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/logging/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.LogView_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.LogView_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.LogView_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_logging_log_view"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_logging_log_view"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.LogView_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/logging/metric/zz_controller.go b/internal/controller/logging/metric/zz_controller.go
index fc5280879..03a236fa4 100755
--- a/internal/controller/logging/metric/zz_controller.go
+++ b/internal/controller/logging/metric/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/logging/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Metric_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Metric_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Metric_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_logging_metric"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_logging_metric"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Metric_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/logging/projectbucketconfig/zz_controller.go b/internal/controller/logging/projectbucketconfig/zz_controller.go
index 2411957e8..b4d7f8ecd 100755
--- a/internal/controller/logging/projectbucketconfig/zz_controller.go
+++ b/internal/controller/logging/projectbucketconfig/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/logging/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ProjectBucketConfig_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ProjectBucketConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ProjectBucketConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_logging_project_bucket_config"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_logging_project_bucket_config"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ProjectBucketConfig_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/logging/projectexclusion/zz_controller.go b/internal/controller/logging/projectexclusion/zz_controller.go
index a51fa79a4..cb19eb33c 100755
--- a/internal/controller/logging/projectexclusion/zz_controller.go
+++ b/internal/controller/logging/projectexclusion/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/logging/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ProjectExclusion_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ProjectExclusion_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ProjectExclusion_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_logging_project_exclusion"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_logging_project_exclusion"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ProjectExclusion_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/logging/projectsink/zz_controller.go b/internal/controller/logging/projectsink/zz_controller.go
index 005420528..b5a89c228 100755
--- a/internal/controller/logging/projectsink/zz_controller.go
+++ b/internal/controller/logging/projectsink/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/logging/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ProjectSink_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ProjectSink_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ProjectSink_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_logging_project_sink"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_logging_project_sink"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ProjectSink_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/memcache/instance/zz_controller.go b/internal/controller/memcache/instance/zz_controller.go
index a3bdcc3bc..198d8e420 100755
--- a/internal/controller/memcache/instance/zz_controller.go
+++ b/internal/controller/memcache/instance/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/memcache/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Instance_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Instance_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Instance_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_memcache_instance"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_memcache_instance"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Instance_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/mlengine/model/zz_controller.go b/internal/controller/mlengine/model/zz_controller.go
index 100a8b005..dc67de6d4 100755
--- a/internal/controller/mlengine/model/zz_controller.go
+++ b/internal/controller/mlengine/model/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/mlengine/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Model_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Model_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Model_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_ml_engine_model"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_ml_engine_model"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Model_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/monitoring/alertpolicy/zz_controller.go b/internal/controller/monitoring/alertpolicy/zz_controller.go
index 478a75c42..7a92efe8d 100755
--- a/internal/controller/monitoring/alertpolicy/zz_controller.go
+++ b/internal/controller/monitoring/alertpolicy/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/monitoring/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.AlertPolicy_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AlertPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AlertPolicy_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_monitoring_alert_policy"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_monitoring_alert_policy"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.AlertPolicy_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/monitoring/customservice/zz_controller.go b/internal/controller/monitoring/customservice/zz_controller.go
index 509f21add..a8508c737 100755
--- a/internal/controller/monitoring/customservice/zz_controller.go
+++ b/internal/controller/monitoring/customservice/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/monitoring/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.CustomService_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.CustomService_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.CustomService_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_monitoring_custom_service"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_monitoring_custom_service"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.CustomService_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/monitoring/dashboard/zz_controller.go b/internal/controller/monitoring/dashboard/zz_controller.go
index ec76eec77..d94af9994 100755
--- a/internal/controller/monitoring/dashboard/zz_controller.go
+++ b/internal/controller/monitoring/dashboard/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/monitoring/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Dashboard_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Dashboard_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Dashboard_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_monitoring_dashboard"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_monitoring_dashboard"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Dashboard_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/monitoring/group/zz_controller.go b/internal/controller/monitoring/group/zz_controller.go
index 6cfd636d1..1f645aead 100755
--- a/internal/controller/monitoring/group/zz_controller.go
+++ b/internal/controller/monitoring/group/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/monitoring/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Group_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Group_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Group_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_monitoring_group"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_monitoring_group"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Group_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/monitoring/metricdescriptor/zz_controller.go b/internal/controller/monitoring/metricdescriptor/zz_controller.go
index 3d321dbbf..a382898bd 100755
--- a/internal/controller/monitoring/metricdescriptor/zz_controller.go
+++ b/internal/controller/monitoring/metricdescriptor/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/monitoring/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.MetricDescriptor_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.MetricDescriptor_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.MetricDescriptor_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_monitoring_metric_descriptor"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_monitoring_metric_descriptor"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.MetricDescriptor_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/monitoring/notificationchannel/zz_controller.go b/internal/controller/monitoring/notificationchannel/zz_controller.go
index de2bbad78..f849cfe8a 100755
--- a/internal/controller/monitoring/notificationchannel/zz_controller.go
+++ b/internal/controller/monitoring/notificationchannel/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/monitoring/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.NotificationChannel_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.NotificationChannel_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.NotificationChannel_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_monitoring_notification_channel"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_monitoring_notification_channel"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.NotificationChannel_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/monitoring/service/zz_controller.go b/internal/controller/monitoring/service/zz_controller.go
index 06d19f43e..1f20f9b52 100755
--- a/internal/controller/monitoring/service/zz_controller.go
+++ b/internal/controller/monitoring/service/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/monitoring/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Service_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Service_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Service_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_monitoring_service"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_monitoring_service"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Service_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/monitoring/slo/zz_controller.go b/internal/controller/monitoring/slo/zz_controller.go
index 65ff96c7d..a76439797 100755
--- a/internal/controller/monitoring/slo/zz_controller.go
+++ b/internal/controller/monitoring/slo/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/monitoring/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.SLO_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SLO_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SLO_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_monitoring_slo"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_monitoring_slo"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.SLO_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/monitoring/uptimecheckconfig/zz_controller.go b/internal/controller/monitoring/uptimecheckconfig/zz_controller.go
index 9dd2543b0..a89b7cd04 100755
--- a/internal/controller/monitoring/uptimecheckconfig/zz_controller.go
+++ b/internal/controller/monitoring/uptimecheckconfig/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/monitoring/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.UptimeCheckConfig_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.UptimeCheckConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.UptimeCheckConfig_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_monitoring_uptime_check_config"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_monitoring_uptime_check_config"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.UptimeCheckConfig_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/networkconnectivity/hub/zz_controller.go b/internal/controller/networkconnectivity/hub/zz_controller.go
index e356e98cc..5aead90ed 100755
--- a/internal/controller/networkconnectivity/hub/zz_controller.go
+++ b/internal/controller/networkconnectivity/hub/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/networkconnectivity/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Hub_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Hub_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Hub_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_network_connectivity_hub"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_network_connectivity_hub"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Hub_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/networkconnectivity/spoke/zz_controller.go b/internal/controller/networkconnectivity/spoke/zz_controller.go
index a7534559a..03ef7427a 100755
--- a/internal/controller/networkconnectivity/spoke/zz_controller.go
+++ b/internal/controller/networkconnectivity/spoke/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/networkconnectivity/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Spoke_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Spoke_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Spoke_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_network_connectivity_spoke"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_network_connectivity_spoke"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Spoke_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/networkmanagement/connectivitytest/zz_controller.go b/internal/controller/networkmanagement/connectivitytest/zz_controller.go
index c7cb496d2..0b6445c2a 100755
--- a/internal/controller/networkmanagement/connectivitytest/zz_controller.go
+++ b/internal/controller/networkmanagement/connectivitytest/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/networkmanagement/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ConnectivityTest_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ConnectivityTest_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ConnectivityTest_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_network_management_connectivity_test"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_network_management_connectivity_test"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ConnectivityTest_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/notebooks/environment/zz_controller.go b/internal/controller/notebooks/environment/zz_controller.go
index edefa4e97..3002dd23e 100755
--- a/internal/controller/notebooks/environment/zz_controller.go
+++ b/internal/controller/notebooks/environment/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/notebooks/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Environment_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Environment_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Environment_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_notebooks_environment"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_notebooks_environment"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Environment_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/notebooks/instance/zz_controller.go b/internal/controller/notebooks/instance/zz_controller.go
index 3471a209c..2c7606810 100755
--- a/internal/controller/notebooks/instance/zz_controller.go
+++ b/internal/controller/notebooks/instance/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/notebooks/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Instance_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Instance_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Instance_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_notebooks_instance"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_notebooks_instance"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Instance_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/notebooks/instanceiammember/zz_controller.go b/internal/controller/notebooks/instanceiammember/zz_controller.go
index 9a5895ab0..01bc36c0b 100755
--- a/internal/controller/notebooks/instanceiammember/zz_controller.go
+++ b/internal/controller/notebooks/instanceiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/notebooks/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.InstanceIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InstanceIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InstanceIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_notebooks_instance_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_notebooks_instance_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.InstanceIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/notebooks/runtime/zz_controller.go b/internal/controller/notebooks/runtime/zz_controller.go
index 70aa1bd98..3c9f8f934 100755
--- a/internal/controller/notebooks/runtime/zz_controller.go
+++ b/internal/controller/notebooks/runtime/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/notebooks/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Runtime_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Runtime_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Runtime_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_notebooks_runtime"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_notebooks_runtime"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Runtime_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/notebooks/runtimeiammember/zz_controller.go b/internal/controller/notebooks/runtimeiammember/zz_controller.go
index f47539b5f..361e30eb8 100755
--- a/internal/controller/notebooks/runtimeiammember/zz_controller.go
+++ b/internal/controller/notebooks/runtimeiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/notebooks/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.RuntimeIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RuntimeIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RuntimeIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_notebooks_runtime_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_notebooks_runtime_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.RuntimeIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/osconfig/ospolicyassignment/zz_controller.go b/internal/controller/osconfig/ospolicyassignment/zz_controller.go
index 2d52924c7..4febdba9e 100755
--- a/internal/controller/osconfig/ospolicyassignment/zz_controller.go
+++ b/internal/controller/osconfig/ospolicyassignment/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/osconfig/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.OsPolicyAssignment_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.OsPolicyAssignment_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.OsPolicyAssignment_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_os_config_os_policy_assignment"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_os_config_os_policy_assignment"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.OsPolicyAssignment_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/osconfig/patchdeployment/zz_controller.go b/internal/controller/osconfig/patchdeployment/zz_controller.go
index c4eeeb4d0..1fe5ce689 100755
--- a/internal/controller/osconfig/patchdeployment/zz_controller.go
+++ b/internal/controller/osconfig/patchdeployment/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/osconfig/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.PatchDeployment_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.PatchDeployment_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.PatchDeployment_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_os_config_patch_deployment"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_os_config_patch_deployment"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.PatchDeployment_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/oslogin/sshpublickey/zz_controller.go b/internal/controller/oslogin/sshpublickey/zz_controller.go
index 21f4a69f3..e5c8f552a 100755
--- a/internal/controller/oslogin/sshpublickey/zz_controller.go
+++ b/internal/controller/oslogin/sshpublickey/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/oslogin/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.SSHPublicKey_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SSHPublicKey_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SSHPublicKey_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_os_login_ssh_public_key"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_os_login_ssh_public_key"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.SSHPublicKey_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/privateca/capool/zz_controller.go b/internal/controller/privateca/capool/zz_controller.go
index 58a5f814d..21996a289 100755
--- a/internal/controller/privateca/capool/zz_controller.go
+++ b/internal/controller/privateca/capool/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/privateca/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.CAPool_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.CAPool_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.CAPool_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_privateca_ca_pool"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_privateca_ca_pool"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.CAPool_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/privateca/capooliammember/zz_controller.go b/internal/controller/privateca/capooliammember/zz_controller.go
index 49f85c781..248b5e7e2 100755
--- a/internal/controller/privateca/capooliammember/zz_controller.go
+++ b/internal/controller/privateca/capooliammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/privateca/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.CAPoolIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.CAPoolIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.CAPoolIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_privateca_ca_pool_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_privateca_ca_pool_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.CAPoolIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/privateca/certificate/zz_controller.go b/internal/controller/privateca/certificate/zz_controller.go
index 7f3cc7b8b..79fb3703c 100755
--- a/internal/controller/privateca/certificate/zz_controller.go
+++ b/internal/controller/privateca/certificate/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/privateca/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Certificate_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Certificate_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Certificate_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_privateca_certificate"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_privateca_certificate"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Certificate_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/privateca/certificateauthority/zz_controller.go b/internal/controller/privateca/certificateauthority/zz_controller.go
index 16be4f550..9d9dbdef3 100755
--- a/internal/controller/privateca/certificateauthority/zz_controller.go
+++ b/internal/controller/privateca/certificateauthority/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/privateca/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.CertificateAuthority_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.CertificateAuthority_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.CertificateAuthority_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_privateca_certificate_authority"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_privateca_certificate_authority"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.CertificateAuthority_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/privateca/certificatetemplate/zz_controller.go b/internal/controller/privateca/certificatetemplate/zz_controller.go
index bbdf0f546..f08e37210 100755
--- a/internal/controller/privateca/certificatetemplate/zz_controller.go
+++ b/internal/controller/privateca/certificatetemplate/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/privateca/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.CertificateTemplate_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.CertificateTemplate_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.CertificateTemplate_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_privateca_certificate_template"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_privateca_certificate_template"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.CertificateTemplate_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/privateca/certificatetemplateiammember/zz_controller.go b/internal/controller/privateca/certificatetemplateiammember/zz_controller.go
index 8857ad26b..b47dcafe2 100755
--- a/internal/controller/privateca/certificatetemplateiammember/zz_controller.go
+++ b/internal/controller/privateca/certificatetemplateiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/privateca/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.CertificateTemplateIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.CertificateTemplateIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.CertificateTemplateIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_privateca_certificate_template_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_privateca_certificate_template_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.CertificateTemplateIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/pubsub/litereservation/zz_controller.go b/internal/controller/pubsub/litereservation/zz_controller.go
index 7f3a16d98..276a610a9 100755
--- a/internal/controller/pubsub/litereservation/zz_controller.go
+++ b/internal/controller/pubsub/litereservation/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/pubsub/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.LiteReservation_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.LiteReservation_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.LiteReservation_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_pubsub_lite_reservation"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_pubsub_lite_reservation"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.LiteReservation_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/pubsub/litesubscription/zz_controller.go b/internal/controller/pubsub/litesubscription/zz_controller.go
index 468bc840d..980d1b4d0 100755
--- a/internal/controller/pubsub/litesubscription/zz_controller.go
+++ b/internal/controller/pubsub/litesubscription/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/pubsub/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.LiteSubscription_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.LiteSubscription_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.LiteSubscription_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_pubsub_lite_subscription"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_pubsub_lite_subscription"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.LiteSubscription_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/pubsub/litetopic/zz_controller.go b/internal/controller/pubsub/litetopic/zz_controller.go
index d22708aaf..37893545b 100755
--- a/internal/controller/pubsub/litetopic/zz_controller.go
+++ b/internal/controller/pubsub/litetopic/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/pubsub/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.LiteTopic_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.LiteTopic_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.LiteTopic_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_pubsub_lite_topic"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_pubsub_lite_topic"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.LiteTopic_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/pubsub/schema/zz_controller.go b/internal/controller/pubsub/schema/zz_controller.go
index 5e9d6a401..54160b3a3 100755
--- a/internal/controller/pubsub/schema/zz_controller.go
+++ b/internal/controller/pubsub/schema/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/pubsub/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Schema_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Schema_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Schema_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_pubsub_schema"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_pubsub_schema"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Schema_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/pubsub/subscription/zz_controller.go b/internal/controller/pubsub/subscription/zz_controller.go
index 6a2d6bb42..df13168ef 100755
--- a/internal/controller/pubsub/subscription/zz_controller.go
+++ b/internal/controller/pubsub/subscription/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/pubsub/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Subscription_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Subscription_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Subscription_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_pubsub_subscription"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_pubsub_subscription"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Subscription_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/pubsub/subscriptioniammember/zz_controller.go b/internal/controller/pubsub/subscriptioniammember/zz_controller.go
index fd323335c..816de6930 100755
--- a/internal/controller/pubsub/subscriptioniammember/zz_controller.go
+++ b/internal/controller/pubsub/subscriptioniammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/pubsub/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.SubscriptionIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SubscriptionIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SubscriptionIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_pubsub_subscription_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_pubsub_subscription_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.SubscriptionIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/pubsub/topic/zz_controller.go b/internal/controller/pubsub/topic/zz_controller.go
index 1d450f0ce..c11345753 100755
--- a/internal/controller/pubsub/topic/zz_controller.go
+++ b/internal/controller/pubsub/topic/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/pubsub/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Topic_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Topic_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Topic_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_pubsub_topic"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_pubsub_topic"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Topic_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/pubsub/topiciammember/zz_controller.go b/internal/controller/pubsub/topiciammember/zz_controller.go
index f341b8555..5269a5415 100755
--- a/internal/controller/pubsub/topiciammember/zz_controller.go
+++ b/internal/controller/pubsub/topiciammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/pubsub/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.TopicIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TopicIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.TopicIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_pubsub_topic_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_pubsub_topic_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.TopicIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/redis/instance/zz_controller.go b/internal/controller/redis/instance/zz_controller.go
index 5e4baaf76..4bc941dcf 100755
--- a/internal/controller/redis/instance/zz_controller.go
+++ b/internal/controller/redis/instance/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/redis/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Instance_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Instance_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Instance_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_redis_instance"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_redis_instance"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Instance_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/secretmanager/secret/zz_controller.go b/internal/controller/secretmanager/secret/zz_controller.go
index 9376dc9ee..53f171e01 100755
--- a/internal/controller/secretmanager/secret/zz_controller.go
+++ b/internal/controller/secretmanager/secret/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/secretmanager/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Secret_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Secret_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Secret_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_secret_manager_secret"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_secret_manager_secret"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Secret_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/secretmanager/secretiammember/zz_controller.go b/internal/controller/secretmanager/secretiammember/zz_controller.go
index 24bb8373c..18d13e08d 100755
--- a/internal/controller/secretmanager/secretiammember/zz_controller.go
+++ b/internal/controller/secretmanager/secretiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/secretmanager/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.SecretIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SecretIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SecretIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_secret_manager_secret_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_secret_manager_secret_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.SecretIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/secretmanager/secretversion/zz_controller.go b/internal/controller/secretmanager/secretversion/zz_controller.go
index e9e6d7457..2ca046f24 100755
--- a/internal/controller/secretmanager/secretversion/zz_controller.go
+++ b/internal/controller/secretmanager/secretversion/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/secretmanager/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.SecretVersion_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SecretVersion_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SecretVersion_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_secret_manager_secret_version"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_secret_manager_secret_version"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.SecretVersion_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/servicenetworking/connection/zz_controller.go b/internal/controller/servicenetworking/connection/zz_controller.go
index 47e07860d..67f8c5d9d 100755
--- a/internal/controller/servicenetworking/connection/zz_controller.go
+++ b/internal/controller/servicenetworking/connection/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/servicenetworking/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Connection_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Connection_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Connection_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_service_networking_connection"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_service_networking_connection"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Connection_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/sourcerepo/repository/zz_controller.go b/internal/controller/sourcerepo/repository/zz_controller.go
index 8bcfadf92..f0f2af968 100755
--- a/internal/controller/sourcerepo/repository/zz_controller.go
+++ b/internal/controller/sourcerepo/repository/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/sourcerepo/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Repository_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Repository_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Repository_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_sourcerepo_repository"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_sourcerepo_repository"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Repository_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/sourcerepo/repositoryiammember/zz_controller.go b/internal/controller/sourcerepo/repositoryiammember/zz_controller.go
index 43bba1853..86427c614 100755
--- a/internal/controller/sourcerepo/repositoryiammember/zz_controller.go
+++ b/internal/controller/sourcerepo/repositoryiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/sourcerepo/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.RepositoryIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RepositoryIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.RepositoryIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_sourcerepo_repository_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_sourcerepo_repository_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.RepositoryIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/spanner/database/zz_controller.go b/internal/controller/spanner/database/zz_controller.go
index 05e3007da..17eb1b58e 100755
--- a/internal/controller/spanner/database/zz_controller.go
+++ b/internal/controller/spanner/database/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/spanner/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Database_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Database_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Database_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_spanner_database"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_spanner_database"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Database_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/spanner/databaseiammember/zz_controller.go b/internal/controller/spanner/databaseiammember/zz_controller.go
index 5ab9556e7..2554028fe 100755
--- a/internal/controller/spanner/databaseiammember/zz_controller.go
+++ b/internal/controller/spanner/databaseiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/spanner/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.DatabaseIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DatabaseIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DatabaseIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_spanner_database_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_spanner_database_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.DatabaseIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/spanner/instance/zz_controller.go b/internal/controller/spanner/instance/zz_controller.go
index 2b1f5bd0d..0df0d8767 100755
--- a/internal/controller/spanner/instance/zz_controller.go
+++ b/internal/controller/spanner/instance/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/spanner/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Instance_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Instance_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Instance_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_spanner_instance"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_spanner_instance"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Instance_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/spanner/instanceiammember/zz_controller.go b/internal/controller/spanner/instanceiammember/zz_controller.go
index 1afa055ed..230497a18 100755
--- a/internal/controller/spanner/instanceiammember/zz_controller.go
+++ b/internal/controller/spanner/instanceiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/spanner/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.InstanceIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InstanceIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.InstanceIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_spanner_instance_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_spanner_instance_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.InstanceIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/sql/database/zz_controller.go b/internal/controller/sql/database/zz_controller.go
index 02af27a7a..a5f9fc463 100755
--- a/internal/controller/sql/database/zz_controller.go
+++ b/internal/controller/sql/database/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/sql/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Database_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Database_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Database_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_sql_database"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_sql_database"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Database_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/sql/databaseinstance/zz_controller.go b/internal/controller/sql/databaseinstance/zz_controller.go
index 112fd2f9a..cb172b134 100755
--- a/internal/controller/sql/databaseinstance/zz_controller.go
+++ b/internal/controller/sql/databaseinstance/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/sql/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.DatabaseInstance_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DatabaseInstance_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DatabaseInstance_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_sql_database_instance"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_sql_database_instance"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.DatabaseInstance_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/sql/sourcerepresentationinstance/zz_controller.go b/internal/controller/sql/sourcerepresentationinstance/zz_controller.go
index 3c26f5aeb..a57d3eb80 100755
--- a/internal/controller/sql/sourcerepresentationinstance/zz_controller.go
+++ b/internal/controller/sql/sourcerepresentationinstance/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/sql/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.SourceRepresentationInstance_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SourceRepresentationInstance_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SourceRepresentationInstance_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_sql_source_representation_instance"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_sql_source_representation_instance"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.SourceRepresentationInstance_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/sql/sslcert/zz_controller.go b/internal/controller/sql/sslcert/zz_controller.go
index c02db1283..1a7c4a62b 100755
--- a/internal/controller/sql/sslcert/zz_controller.go
+++ b/internal/controller/sql/sslcert/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/sql/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.SSLCert_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SSLCert_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.SSLCert_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_sql_ssl_cert"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_sql_ssl_cert"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.SSLCert_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/sql/user/zz_controller.go b/internal/controller/sql/user/zz_controller.go
index 2256eec8c..02d1ab34e 100755
--- a/internal/controller/sql/user/zz_controller.go
+++ b/internal/controller/sql/user/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/sql/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.User_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.User_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.User_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_sql_user"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_sql_user"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.User_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/storage/bucket/zz_controller.go b/internal/controller/storage/bucket/zz_controller.go
index 337381e01..f5ce0f296 100755
--- a/internal/controller/storage/bucket/zz_controller.go
+++ b/internal/controller/storage/bucket/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/storage/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Bucket_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Bucket_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Bucket_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_storage_bucket"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_storage_bucket"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Bucket_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/storage/bucketaccesscontrol/zz_controller.go b/internal/controller/storage/bucketaccesscontrol/zz_controller.go
index cb3f2f46e..11dbba643 100755
--- a/internal/controller/storage/bucketaccesscontrol/zz_controller.go
+++ b/internal/controller/storage/bucketaccesscontrol/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/storage/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.BucketAccessControl_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.BucketAccessControl_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.BucketAccessControl_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_storage_bucket_access_control"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_storage_bucket_access_control"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.BucketAccessControl_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/storage/bucketacl/zz_controller.go b/internal/controller/storage/bucketacl/zz_controller.go
index d9b2b4c4e..a211e1786 100755
--- a/internal/controller/storage/bucketacl/zz_controller.go
+++ b/internal/controller/storage/bucketacl/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/storage/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.BucketACL_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.BucketACL_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.BucketACL_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_storage_bucket_acl"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_storage_bucket_acl"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.BucketACL_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/storage/bucketiammember/zz_controller.go b/internal/controller/storage/bucketiammember/zz_controller.go
index 65ed8ec28..2daa027e4 100755
--- a/internal/controller/storage/bucketiammember/zz_controller.go
+++ b/internal/controller/storage/bucketiammember/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/storage/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.BucketIAMMember_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.BucketIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.BucketIAMMember_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_storage_bucket_iam_member"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_storage_bucket_iam_member"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.BucketIAMMember_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/storage/bucketobject/zz_controller.go b/internal/controller/storage/bucketobject/zz_controller.go
index 1eaa56c01..2ee6f8c5c 100755
--- a/internal/controller/storage/bucketobject/zz_controller.go
+++ b/internal/controller/storage/bucketobject/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/storage/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.BucketObject_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.BucketObject_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.BucketObject_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_storage_bucket_object"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_storage_bucket_object"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.BucketObject_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/storage/defaultobjectaccesscontrol/zz_controller.go b/internal/controller/storage/defaultobjectaccesscontrol/zz_controller.go
index b7e2bcb4f..50a1027d1 100755
--- a/internal/controller/storage/defaultobjectaccesscontrol/zz_controller.go
+++ b/internal/controller/storage/defaultobjectaccesscontrol/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/storage/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.DefaultObjectAccessControl_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DefaultObjectAccessControl_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DefaultObjectAccessControl_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_storage_default_object_access_control"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_storage_default_object_access_control"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.DefaultObjectAccessControl_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/storage/defaultobjectacl/zz_controller.go b/internal/controller/storage/defaultobjectacl/zz_controller.go
index bed2cdd3b..661b84278 100755
--- a/internal/controller/storage/defaultobjectacl/zz_controller.go
+++ b/internal/controller/storage/defaultobjectacl/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/storage/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.DefaultObjectACL_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DefaultObjectACL_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.DefaultObjectACL_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_storage_default_object_acl"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_storage_default_object_acl"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.DefaultObjectACL_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/storage/notification/zz_controller.go b/internal/controller/storage/notification/zz_controller.go
index c66aa4528..36a50acd6 100755
--- a/internal/controller/storage/notification/zz_controller.go
+++ b/internal/controller/storage/notification/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/storage/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Notification_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Notification_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Notification_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_storage_notification"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_storage_notification"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Notification_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/storage/objectaccesscontrol/zz_controller.go b/internal/controller/storage/objectaccesscontrol/zz_controller.go
index 12648f032..6a5fb7604 100755
--- a/internal/controller/storage/objectaccesscontrol/zz_controller.go
+++ b/internal/controller/storage/objectaccesscontrol/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/storage/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ObjectAccessControl_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ObjectAccessControl_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ObjectAccessControl_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_storage_object_access_control"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_storage_object_access_control"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ObjectAccessControl_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/storage/objectacl/zz_controller.go b/internal/controller/storage/objectacl/zz_controller.go
index 2e0d6c66d..69831436d 100755
--- a/internal/controller/storage/objectacl/zz_controller.go
+++ b/internal/controller/storage/objectacl/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/storage/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.ObjectACL_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ObjectACL_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.ObjectACL_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_storage_object_acl"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_storage_object_acl"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.ObjectACL_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/storagetransfer/agentpool/zz_controller.go b/internal/controller/storagetransfer/agentpool/zz_controller.go
index 368831cfc..71a777a33 100755
--- a/internal/controller/storagetransfer/agentpool/zz_controller.go
+++ b/internal/controller/storagetransfer/agentpool/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/storagetransfer/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.AgentPool_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AgentPool_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.AgentPool_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_storage_transfer_agent_pool"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_storage_transfer_agent_pool"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.AgentPool_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/tpu/node/zz_controller.go b/internal/controller/tpu/node/zz_controller.go
index e40ec7206..cade2ee4e 100755
--- a/internal/controller/tpu/node/zz_controller.go
+++ b/internal/controller/tpu/node/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/tpu/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Node_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Node_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Node_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_tpu_node"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_tpu_node"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Node_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/vertexai/dataset/zz_controller.go b/internal/controller/vertexai/dataset/zz_controller.go
index 4d5d73961..a3c419540 100755
--- a/internal/controller/vertexai/dataset/zz_controller.go
+++ b/internal/controller/vertexai/dataset/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/vertexai/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Dataset_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Dataset_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Dataset_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_vertex_ai_dataset"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_vertex_ai_dataset"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Dataset_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/vertexai/featurestore/zz_controller.go b/internal/controller/vertexai/featurestore/zz_controller.go
index ccf5e2f11..a18140967 100755
--- a/internal/controller/vertexai/featurestore/zz_controller.go
+++ b/internal/controller/vertexai/featurestore/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/vertexai/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Featurestore_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Featurestore_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Featurestore_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_vertex_ai_featurestore"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_vertex_ai_featurestore"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Featurestore_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/vertexai/featurestoreentitytype/zz_controller.go b/internal/controller/vertexai/featurestoreentitytype/zz_controller.go
index 6c17aa0f4..4581e803b 100755
--- a/internal/controller/vertexai/featurestoreentitytype/zz_controller.go
+++ b/internal/controller/vertexai/featurestoreentitytype/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/vertexai/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.FeaturestoreEntitytype_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.FeaturestoreEntitytype_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.FeaturestoreEntitytype_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_vertex_ai_featurestore_entitytype"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_vertex_ai_featurestore_entitytype"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.FeaturestoreEntitytype_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/vertexai/tensorboard/zz_controller.go b/internal/controller/vertexai/tensorboard/zz_controller.go
index f311be11e..6504714cf 100755
--- a/internal/controller/vertexai/tensorboard/zz_controller.go
+++ b/internal/controller/vertexai/tensorboard/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/vertexai/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Tensorboard_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Tensorboard_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Tensorboard_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_vertex_ai_tensorboard"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_vertex_ai_tensorboard"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Tensorboard_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/vpcaccess/connector/zz_controller.go b/internal/controller/vpcaccess/connector/zz_controller.go
index 54ba785da..0051904f6 100755
--- a/internal/controller/vpcaccess/connector/zz_controller.go
+++ b/internal/controller/vpcaccess/connector/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/vpcaccess/v1beta1"
@@ -49,14 +49,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Connector_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Connector_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Connector_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_vpc_access_connector"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_vpc_access_connector"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Connector_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/internal/controller/workflows/workflow/zz_controller.go b/internal/controller/workflows/workflow/zz_controller.go
index a1fcb017e..1a4891164 100755
--- a/internal/controller/workflows/workflow/zz_controller.go
+++ b/internal/controller/workflows/workflow/zz_controller.go
@@ -32,7 +32,7 @@ import (
 	xpresource "github.com/crossplane/crossplane-runtime/pkg/resource"
 	tjcontroller "github.com/crossplane/upjet/pkg/controller"
 	"github.com/crossplane/upjet/pkg/controller/handler"
-	"github.com/crossplane/upjet/pkg/terraform"
+	"github.com/crossplane/upjet/pkg/metrics"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	v1beta1 "github.com/upbound/provider-gcp/apis/workflows/v1beta1"
@@ -48,14 +48,18 @@ func Setup(mgr ctrl.Manager, o tjcontroller.Options) error {
 		cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), *o.SecretStoreConfigGVK, connection.WithTLSConfig(o.ESSOptions.TLSConfig)))
 	}
 	eventHandler := handler.NewEventHandler(handler.WithLogger(o.Logger.WithValues("gvk", v1beta1.Workflow_GroupVersionKind)))
-	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Workflow_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler))
+	ac := tjcontroller.NewAPICallbacks(mgr, xpresource.ManagedKind(v1beta1.Workflow_GroupVersionKind), tjcontroller.WithEventHandler(eventHandler), tjcontroller.WithStatusUpdates(false))
 	opts := []managed.ReconcilerOption{
-		managed.WithExternalConnecter(tjcontroller.NewConnector(mgr.GetClient(), o.WorkspaceStore, o.SetupFn, o.Provider.Resources["google_workflows_workflow"], tjcontroller.WithLogger(o.Logger), tjcontroller.WithConnectorEventHandler(eventHandler),
-			tjcontroller.WithCallbackProvider(ac),
-		)),
+		managed.WithExternalConnecter(
+			tjcontroller.NewNoForkAsyncConnector(mgr.GetClient(), o.OperationTrackerStore, o.SetupFn, o.Provider.Resources["google_workflows_workflow"],
+				tjcontroller.WithNoForkAsyncLogger(o.Logger),
+				tjcontroller.WithNoForkAsyncConnectorEventHandler(eventHandler),
+				tjcontroller.WithNoForkAsyncCallbackProvider(ac),
+				tjcontroller.WithNoForkAsyncMetricRecorder(metrics.NewMetricRecorder(v1beta1.Workflow_GroupVersionKind, mgr, o.PollInterval)),
+				tjcontroller.WithNoForkAsyncManagementPolicies(o.Features.Enabled(features.EnableBetaManagementPolicies)))),
 		managed.WithLogger(o.Logger.WithValues("controller", name)),
 		managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))),
-		managed.WithFinalizer(terraform.NewWorkspaceFinalizer(o.WorkspaceStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
+		managed.WithFinalizer(tjcontroller.NewNoForkFinalizer(o.OperationTrackerStore, xpresource.NewAPIFinalizer(mgr.GetClient(), managed.FinalizerName))),
 		managed.WithTimeout(3 * time.Minute),
 		managed.WithInitializers(initializers),
 		managed.WithConnectionPublishers(cps...),
diff --git a/package/crds/accesscontextmanager.gcp.upbound.io_serviceperimeters.yaml b/package/crds/accesscontextmanager.gcp.upbound.io_serviceperimeters.yaml
index 461dfb480..96868a54a 100644
--- a/package/crds/accesscontextmanager.gcp.upbound.io_serviceperimeters.yaml
+++ b/package/crds/accesscontextmanager.gcp.upbound.io_serviceperimeters.yaml
@@ -913,6 +913,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         vpcAccessibleServices:
                           description: Specifies how APIs are allowed to communicate
                             within the Service Perimeter. Structure is documented
@@ -926,6 +927,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               enableRestriction:
                                 description: Whether to restrict API calls within
                                   the Service Perimeter to the list of APIs specified
@@ -1515,6 +1517,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         vpcAccessibleServices:
                           description: Specifies how APIs are allowed to communicate
                             within the Service Perimeter. Structure is documented
@@ -1528,6 +1531,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               enableRestriction:
                                 description: Whether to restrict API calls within
                                   the Service Perimeter to the list of APIs specified
@@ -2330,6 +2334,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         vpcAccessibleServices:
                           description: Specifies how APIs are allowed to communicate
                             within the Service Perimeter. Structure is documented
@@ -2343,6 +2348,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               enableRestriction:
                                 description: Whether to restrict API calls within
                                   the Service Perimeter to the list of APIs specified
diff --git a/package/crds/activedirectory.gcp.upbound.io_domains.yaml b/package/crds/activedirectory.gcp.upbound.io_domains.yaml
index 184f0d53d..68c2073e8 100644
--- a/package/crds/activedirectory.gcp.upbound.io_domains.yaml
+++ b/package/crds/activedirectory.gcp.upbound.io_domains.yaml
@@ -80,6 +80,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   domainName:
                     description: The fully qualified domain name. e.g. mydomain.myorganization.com,
                       with the restrictions, https://cloud.google.com/managed-microsoft-ad/reference/rest/v1/projects.locations.global.domains.
@@ -89,6 +90,7 @@ spec:
                       type: string
                     description: Resource labels that can contain user-provided metadata
                     type: object
+                    x-kubernetes-map-type: granular
                   locations:
                     description: Locations where domain needs to be provisioned. [regions][compute/docs/regions-zones/]
                       e.g. us-west1 or us-east4 Service supports up to 4 locations
@@ -132,6 +134,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   domainName:
                     description: The fully qualified domain name. e.g. mydomain.myorganization.com,
                       with the restrictions, https://cloud.google.com/managed-microsoft-ad/reference/rest/v1/projects.locations.global.domains.
@@ -141,6 +144,7 @@ spec:
                       type: string
                     description: Resource labels that can contain user-provided metadata
                     type: object
+                    x-kubernetes-map-type: granular
                   locations:
                     description: Locations where domain needs to be provisioned. [regions][compute/docs/regions-zones/]
                       e.g. us-west1 or us-east4 Service supports up to 4 locations
@@ -350,6 +354,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   domainName:
                     description: The fully qualified domain name. e.g. mydomain.myorganization.com,
                       with the restrictions, https://cloud.google.com/managed-microsoft-ad/reference/rest/v1/projects.locations.global.domains.
@@ -367,6 +372,7 @@ spec:
                       type: string
                     description: Resource labels that can contain user-provided metadata
                     type: object
+                    x-kubernetes-map-type: granular
                   locations:
                     description: Locations where domain needs to be provisioned. [regions][compute/docs/regions-zones/]
                       e.g. us-west1 or us-east4 Service supports up to 4 locations
diff --git a/package/crds/alloydb.gcp.upbound.io_backups.yaml b/package/crds/alloydb.gcp.upbound.io_backups.yaml
index 0c0db84a1..3a1de1e88 100644
--- a/package/crds/alloydb.gcp.upbound.io_backups.yaml
+++ b/package/crds/alloydb.gcp.upbound.io_backups.yaml
@@ -164,6 +164,7 @@ spec:
                       type: string
                     description: User-defined labels for the alloydb backup.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The location where the alloydb backup should reside.
                     type: string
@@ -207,6 +208,7 @@ spec:
                       type: string
                     description: User-defined labels for the alloydb backup.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -427,6 +429,7 @@ spec:
                       type: string
                     description: User-defined labels for the alloydb backup.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The location where the alloydb backup should reside.
                     type: string
diff --git a/package/crds/alloydb.gcp.upbound.io_clusters.yaml b/package/crds/alloydb.gcp.upbound.io_clusters.yaml
index 2305978e3..2f3fe5a71 100644
--- a/package/crds/alloydb.gcp.upbound.io_clusters.yaml
+++ b/package/crds/alloydb.gcp.upbound.io_clusters.yaml
@@ -104,6 +104,7 @@ spec:
                           description: Labels to apply to backups created using this
                             configuration.
                           type: object
+                          x-kubernetes-map-type: granular
                         location:
                           description: The location where the backup will be stored.
                             Currently, the only supported option is to store the backup
@@ -263,6 +264,7 @@ spec:
                       type: string
                     description: User-defined labels for the alloydb cluster.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The location where the alloydb cluster should reside.
                     type: string
@@ -400,6 +402,7 @@ spec:
                           description: Labels to apply to backups created using this
                             configuration.
                           type: object
+                          x-kubernetes-map-type: granular
                         quantityBasedRetention:
                           description: Quantity-based Backup retention policy to retain
                             recent backups. Conflicts with 'time_based_retention',
@@ -533,6 +536,7 @@ spec:
                       type: string
                     description: User-defined labels for the alloydb cluster.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -740,6 +744,7 @@ spec:
                           description: Labels to apply to backups created using this
                             configuration.
                           type: object
+                          x-kubernetes-map-type: granular
                         location:
                           description: The location where the backup will be stored.
                             Currently, the only supported option is to store the backup
@@ -952,6 +957,7 @@ spec:
                       type: string
                     description: User-defined labels for the alloydb cluster.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The location where the alloydb cluster should reside.
                     type: string
diff --git a/package/crds/alloydb.gcp.upbound.io_instances.yaml b/package/crds/alloydb.gcp.upbound.io_instances.yaml
index b3361a036..2bbcbcc92 100644
--- a/package/crds/alloydb.gcp.upbound.io_instances.yaml
+++ b/package/crds/alloydb.gcp.upbound.io_instances.yaml
@@ -73,6 +73,7 @@ spec:
                     description: Annotations to allow client tools to store small
                       amount of arbitrary data. This is distinct from labels.
                     type: object
+                    x-kubernetes-map-type: granular
                   availabilityType:
                     description: '''Availability type of an Instance. Defaults to
                       REGIONAL for both primary and read instances. Note that primary
@@ -171,6 +172,7 @@ spec:
                       for reads, e.g. for enabling columnar cache on a read instance.
                       Flags set on read instance may or may not be present on primary.
                     type: object
+                    x-kubernetes-map-type: granular
                   displayName:
                     description: User-settable and human-readable display name for
                       the Instance.
@@ -193,6 +195,7 @@ spec:
                       type: string
                     description: User-defined labels for the alloydb instance.
                     type: object
+                    x-kubernetes-map-type: granular
                   machineConfig:
                     description: Configurations for the machines that host the underlying
                       database engine. Structure is documented below.
@@ -233,6 +236,7 @@ spec:
                     description: Annotations to allow client tools to store small
                       amount of arbitrary data. This is distinct from labels.
                     type: object
+                    x-kubernetes-map-type: granular
                   availabilityType:
                     description: '''Availability type of an Instance. Defaults to
                       REGIONAL for both primary and read instances. Note that primary
@@ -254,6 +258,7 @@ spec:
                       for reads, e.g. for enabling columnar cache on a read instance.
                       Flags set on read instance may or may not be present on primary.
                     type: object
+                    x-kubernetes-map-type: granular
                   displayName:
                     description: User-settable and human-readable display name for
                       the Instance.
@@ -276,6 +281,7 @@ spec:
                       type: string
                     description: User-defined labels for the alloydb instance.
                     type: object
+                    x-kubernetes-map-type: granular
                   machineConfig:
                     description: Configurations for the machines that host the underlying
                       database engine. Structure is documented below.
@@ -474,6 +480,7 @@ spec:
                     description: Annotations to allow client tools to store small
                       amount of arbitrary data. This is distinct from labels.
                     type: object
+                    x-kubernetes-map-type: granular
                   availabilityType:
                     description: '''Availability type of an Instance. Defaults to
                       REGIONAL for both primary and read instances. Note that primary
@@ -502,6 +509,7 @@ spec:
                       for reads, e.g. for enabling columnar cache on a read instance.
                       Flags set on read instance may or may not be present on primary.
                     type: object
+                    x-kubernetes-map-type: granular
                   displayName:
                     description: User-settable and human-readable display name for
                       the Instance.
@@ -531,6 +539,7 @@ spec:
                       type: string
                     description: User-defined labels for the alloydb instance.
                     type: object
+                    x-kubernetes-map-type: granular
                   machineConfig:
                     description: Configurations for the machines that host the underlying
                       database engine. Structure is documented below.
diff --git a/package/crds/appengine.gcp.upbound.io_standardappversions.yaml b/package/crds/appengine.gcp.upbound.io_standardappversions.yaml
index dc91c3e4f..0ff97b70c 100644
--- a/package/crds/appengine.gcp.upbound.io_standardappversions.yaml
+++ b/package/crds/appengine.gcp.upbound.io_standardappversions.yaml
@@ -211,6 +211,7 @@ spec:
                       type: string
                     description: Environment variables available to the application.
                     type: object
+                    x-kubernetes-map-type: granular
                   handlers:
                     description: An ordered list of URL-matching patterns that should
                       be applied to incoming requests. The first matching URL handles
@@ -281,6 +282,7 @@ spec:
                                   from these URLs. An object containing a list of
                                   "key:value" value pairs.".
                                 type: object
+                                x-kubernetes-map-type: granular
                               mimeType:
                                 description: MIME type used to serve all files served
                                   by this handler. Defaults to file-specific MIME
@@ -324,6 +326,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   instanceClass:
                     description: 'Instance class that is used to run this version.
                       Valid values are AutomaticScaling: F1, F2, F4, F4_1G BasicScaling
@@ -638,6 +641,7 @@ spec:
                       type: string
                     description: Environment variables available to the application.
                     type: object
+                    x-kubernetes-map-type: granular
                   handlers:
                     description: An ordered list of URL-matching patterns that should
                       be applied to incoming requests. The first matching URL handles
@@ -708,6 +712,7 @@ spec:
                                   from these URLs. An object containing a list of
                                   "key:value" value pairs.".
                                 type: object
+                                x-kubernetes-map-type: granular
                               mimeType:
                                 description: MIME type used to serve all files served
                                   by this handler. Defaults to file-specific MIME
@@ -751,6 +756,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   instanceClass:
                     description: 'Instance class that is used to run this version.
                       Valid values are AutomaticScaling: F1, F2, F4, F4_1G BasicScaling
@@ -1145,6 +1151,7 @@ spec:
                       type: string
                     description: Environment variables available to the application.
                     type: object
+                    x-kubernetes-map-type: granular
                   handlers:
                     description: An ordered list of URL-matching patterns that should
                       be applied to incoming requests. The first matching URL handles
@@ -1215,6 +1222,7 @@ spec:
                                   from these URLs. An object containing a list of
                                   "key:value" value pairs.".
                                 type: object
+                                x-kubernetes-map-type: granular
                               mimeType:
                                 description: MIME type used to serve all files served
                                   by this handler. Defaults to file-specific MIME
@@ -1261,6 +1269,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   instanceClass:
                     description: 'Instance class that is used to run this version.
                       Valid values are AutomaticScaling: F1, F2, F4, F4_1G BasicScaling
diff --git a/package/crds/artifact.gcp.upbound.io_registryrepositories.yaml b/package/crds/artifact.gcp.upbound.io_registryrepositories.yaml
index 967834c27..29cac41fb 100644
--- a/package/crds/artifact.gcp.upbound.io_registryrepositories.yaml
+++ b/package/crds/artifact.gcp.upbound.io_registryrepositories.yaml
@@ -104,6 +104,7 @@ spec:
                       and may only contain lowercase letters, numeric characters,
                       underscores, and dashes.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The name of the location this repository is located
                       in.
@@ -348,6 +349,7 @@ spec:
                       and may only contain lowercase letters, numeric characters,
                       underscores, and dashes.
                     type: object
+                    x-kubernetes-map-type: granular
                   mavenConfig:
                     description: MavenRepositoryConfig is maven related repository
                       details. Provides additional configuration details for repositories
@@ -668,6 +670,7 @@ spec:
                       and may only contain lowercase letters, numeric characters,
                       underscores, and dashes.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The name of the location this repository is located
                       in.
diff --git a/package/crds/beyondcorp.gcp.upbound.io_appconnections.yaml b/package/crds/beyondcorp.gcp.upbound.io_appconnections.yaml
index 68e1a3a79..666125702 100644
--- a/package/crds/beyondcorp.gcp.upbound.io_appconnections.yaml
+++ b/package/crds/beyondcorp.gcp.upbound.io_appconnections.yaml
@@ -189,6 +189,7 @@ spec:
                       type: string
                     description: Resource labels to represent user provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: ID of the AppConnection.
                     type: string
@@ -257,6 +258,7 @@ spec:
                       type: string
                     description: Resource labels to represent user provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: ID of the AppConnection.
                     type: string
@@ -505,6 +507,7 @@ spec:
                       type: string
                     description: Resource labels to represent user provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: ID of the AppConnection.
                     type: string
diff --git a/package/crds/beyondcorp.gcp.upbound.io_appconnectors.yaml b/package/crds/beyondcorp.gcp.upbound.io_appconnectors.yaml
index 8beed7553..e7a95183b 100644
--- a/package/crds/beyondcorp.gcp.upbound.io_appconnectors.yaml
+++ b/package/crds/beyondcorp.gcp.upbound.io_appconnectors.yaml
@@ -76,6 +76,7 @@ spec:
                       type: string
                     description: Resource labels to represent user provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   principalInfo:
                     description: Principal information about the Identity of the AppConnector.
                       Structure is documented below.
@@ -203,6 +204,7 @@ spec:
                       type: string
                     description: Resource labels to represent user provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   principalInfo:
                     description: Principal information about the Identity of the AppConnector.
                       Structure is documented below.
@@ -402,6 +404,7 @@ spec:
                       type: string
                     description: Resource labels to represent user provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   principalInfo:
                     description: Principal information about the Identity of the AppConnector.
                       Structure is documented below.
diff --git a/package/crds/beyondcorp.gcp.upbound.io_appgateways.yaml b/package/crds/beyondcorp.gcp.upbound.io_appgateways.yaml
index 4920d0b65..5fd8f9a3c 100644
--- a/package/crds/beyondcorp.gcp.upbound.io_appgateways.yaml
+++ b/package/crds/beyondcorp.gcp.upbound.io_appgateways.yaml
@@ -81,6 +81,7 @@ spec:
                       type: string
                     description: Resource labels to represent user provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -121,6 +122,7 @@ spec:
                       type: string
                     description: Resource labels to represent user provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -325,6 +327,7 @@ spec:
                       type: string
                     description: Resource labels to represent user provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
diff --git a/package/crds/bigquery.gcp.upbound.io_datasetiambindings.yaml b/package/crds/bigquery.gcp.upbound.io_datasetiambindings.yaml
index 2ec6a8f31..c4cb14255 100644
--- a/package/crds/bigquery.gcp.upbound.io_datasetiambindings.yaml
+++ b/package/crds/bigquery.gcp.upbound.io_datasetiambindings.yaml
@@ -157,6 +157,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   project:
                     type: string
                   role:
@@ -191,6 +192,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   project:
                     type: string
                 type: object
@@ -385,6 +387,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   project:
                     type: string
                   role:
diff --git a/package/crds/bigquery.gcp.upbound.io_datasets.yaml b/package/crds/bigquery.gcp.upbound.io_datasets.yaml
index c9e716026..a09cc2596 100644
--- a/package/crds/bigquery.gcp.upbound.io_datasets.yaml
+++ b/package/crds/bigquery.gcp.upbound.io_datasets.yaml
@@ -716,6 +716,7 @@ spec:
                     description: The labels associated with this dataset. You can
                       use these to organize and group your datasets
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The geographic location where the dataset should
                       reside. See official docs.
@@ -887,6 +888,7 @@ spec:
                     description: The labels associated with this dataset. You can
                       use these to organize and group your datasets
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The geographic location where the dataset should
                       reside. See official docs.
@@ -1246,6 +1248,7 @@ spec:
                     description: The labels associated with this dataset. You can
                       use these to organize and group your datasets
                     type: object
+                    x-kubernetes-map-type: granular
                   lastModifiedTime:
                     description: The date when this dataset or any of its tables was
                       last modified, in milliseconds since the epoch.
diff --git a/package/crds/bigquery.gcp.upbound.io_datatransferconfigs.yaml b/package/crds/bigquery.gcp.upbound.io_datatransferconfigs.yaml
index 354ad0cdb..0e4d53998 100644
--- a/package/crds/bigquery.gcp.upbound.io_datatransferconfigs.yaml
+++ b/package/crds/bigquery.gcp.upbound.io_datatransferconfigs.yaml
@@ -195,6 +195,7 @@ spec:
                       be updated (due to api limitations) please force recreation
                       of the resource.'
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -344,6 +345,7 @@ spec:
                       be updated (due to api limitations) please force recreation
                       of the resource.'
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -649,6 +651,7 @@ spec:
                       be updated (due to api limitations) please force recreation
                       of the resource.'
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
diff --git a/package/crds/bigquery.gcp.upbound.io_jobs.yaml b/package/crds/bigquery.gcp.upbound.io_jobs.yaml
index b8213860d..a419d6adf 100644
--- a/package/crds/bigquery.gcp.upbound.io_jobs.yaml
+++ b/package/crds/bigquery.gcp.upbound.io_jobs.yaml
@@ -647,6 +647,7 @@ spec:
                     description: The labels associated with this job. You can use
                       these to organize and group your jobs.
                     type: object
+                    x-kubernetes-map-type: granular
                   load:
                     description: Configures a load job. Structure is documented below.
                     items:
@@ -1673,6 +1674,7 @@ spec:
                     description: The labels associated with this job. You can use
                       these to organize and group your jobs.
                     type: object
+                    x-kubernetes-map-type: granular
                   load:
                     description: Configures a load job. Structure is documented below.
                     items:
@@ -2472,6 +2474,7 @@ spec:
                     description: The labels associated with this job. You can use
                       these to organize and group your jobs.
                     type: object
+                    x-kubernetes-map-type: granular
                   load:
                     description: Configures a load job. Structure is documented below.
                     items:
diff --git a/package/crds/bigquery.gcp.upbound.io_tableiambindings.yaml b/package/crds/bigquery.gcp.upbound.io_tableiambindings.yaml
index 5c96220a1..15aea7b74 100644
--- a/package/crds/bigquery.gcp.upbound.io_tableiambindings.yaml
+++ b/package/crds/bigquery.gcp.upbound.io_tableiambindings.yaml
@@ -157,6 +157,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   project:
                     type: string
                   role:
@@ -264,6 +265,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   project:
                     type: string
                   role:
@@ -464,6 +466,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   project:
                     type: string
                   role:
diff --git a/package/crds/bigquery.gcp.upbound.io_tables.yaml b/package/crds/bigquery.gcp.upbound.io_tables.yaml
index 63416e0a6..c66866b6c 100644
--- a/package/crds/bigquery.gcp.upbound.io_tables.yaml
+++ b/package/crds/bigquery.gcp.upbound.io_tables.yaml
@@ -392,6 +392,7 @@ spec:
                       type: string
                     description: A mapping of labels to assign to the resource.
                     type: object
+                    x-kubernetes-map-type: granular
                   materializedView:
                     description: If specified, configures this table as a materialized
                       view. Structure is documented below.
@@ -749,6 +750,7 @@ spec:
                       type: string
                     description: A mapping of labels to assign to the resource.
                     type: object
+                    x-kubernetes-map-type: granular
                   materializedView:
                     description: If specified, configures this table as a materialized
                       view. Structure is documented below.
@@ -1273,6 +1275,7 @@ spec:
                       type: string
                     description: A mapping of labels to assign to the resource.
                     type: object
+                    x-kubernetes-map-type: granular
                   lastModifiedTime:
                     description: The time when this table was last modified, in milliseconds
                       since the epoch.
diff --git a/package/crds/bigtable.gcp.upbound.io_instanceiambindings.yaml b/package/crds/bigtable.gcp.upbound.io_instanceiambindings.yaml
index 8471d90c4..5590bb9bd 100644
--- a/package/crds/bigtable.gcp.upbound.io_instanceiambindings.yaml
+++ b/package/crds/bigtable.gcp.upbound.io_instanceiambindings.yaml
@@ -84,6 +84,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   project:
                     type: string
                   role:
@@ -119,6 +120,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   project:
                     type: string
                 type: object
@@ -313,6 +315,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   project:
                     type: string
                   role:
diff --git a/package/crds/bigtable.gcp.upbound.io_instances.yaml b/package/crds/bigtable.gcp.upbound.io_instances.yaml
index 3f7eee7ab..4a68ca629 100644
--- a/package/crds/bigtable.gcp.upbound.io_instances.yaml
+++ b/package/crds/bigtable.gcp.upbound.io_instances.yaml
@@ -160,6 +160,7 @@ spec:
                     description: A set of key/value label pairs to assign to the resource.
                       Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -270,6 +271,7 @@ spec:
                     description: A set of key/value label pairs to assign to the resource.
                       Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -536,6 +538,7 @@ spec:
                     description: A set of key/value label pairs to assign to the resource.
                       Label keys must follow the requirements at https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
diff --git a/package/crds/bigtable.gcp.upbound.io_tableiambindings.yaml b/package/crds/bigtable.gcp.upbound.io_tableiambindings.yaml
index 1520bcb9e..97351a644 100644
--- a/package/crds/bigtable.gcp.upbound.io_tableiambindings.yaml
+++ b/package/crds/bigtable.gcp.upbound.io_tableiambindings.yaml
@@ -84,6 +84,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   project:
                     type: string
                   role:
@@ -123,6 +124,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   project:
                     type: string
                 type: object
@@ -321,6 +323,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   project:
                     type: string
                   role:
diff --git a/package/crds/binaryauthorization.gcp.upbound.io_policies.yaml b/package/crds/binaryauthorization.gcp.upbound.io_policies.yaml
index a343aa1f5..47251fcdd 100644
--- a/package/crds/binaryauthorization.gcp.upbound.io_policies.yaml
+++ b/package/crds/binaryauthorization.gcp.upbound.io_policies.yaml
@@ -117,6 +117,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   defaultAdmissionRule:
@@ -147,6 +148,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   description:
@@ -225,6 +227,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   defaultAdmissionRule:
@@ -255,6 +258,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   description:
@@ -491,6 +495,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   defaultAdmissionRule:
@@ -521,6 +526,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   description:
diff --git a/package/crds/certificatemanager.gcp.upbound.io_certificatemapentries.yaml b/package/crds/certificatemanager.gcp.upbound.io_certificatemapentries.yaml
index 993163136..c070ed622 100644
--- a/package/crds/certificatemanager.gcp.upbound.io_certificatemapentries.yaml
+++ b/package/crds/certificatemanager.gcp.upbound.io_certificatemapentries.yaml
@@ -91,6 +91,7 @@ spec:
                       Entry. An object containing a list of "key": value pairs. Example:
                       { "name": "wrench", "mass": "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   map:
                     description: A map entry that is inputted into the cetrificate
                       map
@@ -214,6 +215,7 @@ spec:
                       Entry. An object containing a list of "key": value pairs. Example:
                       { "name": "wrench", "mass": "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   matcher:
                     description: A predefined matcher for particular cases, other
                       than SNI selection
@@ -425,6 +427,7 @@ spec:
                       Entry. An object containing a list of "key": value pairs. Example:
                       { "name": "wrench", "mass": "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   map:
                     description: A map entry that is inputted into the cetrificate
                       map
diff --git a/package/crds/certificatemanager.gcp.upbound.io_certificatemaps.yaml b/package/crds/certificatemanager.gcp.upbound.io_certificatemaps.yaml
index 8a4b86d0b..75e241902 100644
--- a/package/crds/certificatemanager.gcp.upbound.io_certificatemaps.yaml
+++ b/package/crds/certificatemanager.gcp.upbound.io_certificatemaps.yaml
@@ -76,6 +76,7 @@ spec:
                       type: string
                     description: Set of labels associated with a Certificate Map resource.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -101,6 +102,7 @@ spec:
                       type: string
                     description: Set of labels associated with a Certificate Map resource.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -320,6 +322,7 @@ spec:
                       type: string
                     description: Set of labels associated with a Certificate Map resource.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
diff --git a/package/crds/certificatemanager.gcp.upbound.io_certificates.yaml b/package/crds/certificatemanager.gcp.upbound.io_certificates.yaml
index 31c9e2fd8..79ba015c2 100644
--- a/package/crds/certificatemanager.gcp.upbound.io_certificates.yaml
+++ b/package/crds/certificatemanager.gcp.upbound.io_certificates.yaml
@@ -76,6 +76,7 @@ spec:
                     description: Set of label tags associated with the Certificate
                       resource.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The Certificate Manager location. If not specified,
                       "global" is used.
@@ -218,6 +219,7 @@ spec:
                     description: Set of label tags associated with the Certificate
                       resource.
                     type: object
+                    x-kubernetes-map-type: granular
                   managed:
                     description: Configuration and state of a Managed Certificate.
                       Certificate Manager provisions and renews Managed Certificates
@@ -454,6 +456,7 @@ spec:
                     description: Set of label tags associated with the Certificate
                       resource.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The Certificate Manager location. If not specified,
                       "global" is used.
diff --git a/package/crds/certificatemanager.gcp.upbound.io_dnsauthorizations.yaml b/package/crds/certificatemanager.gcp.upbound.io_dnsauthorizations.yaml
index d835138b0..3075ef877 100644
--- a/package/crds/certificatemanager.gcp.upbound.io_dnsauthorizations.yaml
+++ b/package/crds/certificatemanager.gcp.upbound.io_dnsauthorizations.yaml
@@ -82,6 +82,7 @@ spec:
                     description: Set of label tags associated with the DNS Authorization
                       resource.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -114,6 +115,7 @@ spec:
                     description: Set of label tags associated with the DNS Authorization
                       resource.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -325,6 +327,7 @@ spec:
                     description: Set of label tags associated with the DNS Authorization
                       resource.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
diff --git a/package/crds/cloudbuild.gcp.upbound.io_triggers.yaml b/package/crds/cloudbuild.gcp.upbound.io_triggers.yaml
index 57fceb322..17cfd975a 100644
--- a/package/crds/cloudbuild.gcp.upbound.io_triggers.yaml
+++ b/package/crds/cloudbuild.gcp.upbound.io_triggers.yaml
@@ -370,6 +370,7 @@ spec:
                                   crypto key. These values must be specified in the
                                   build's Secret.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         source:
@@ -418,6 +419,7 @@ spec:
                                         type: string
                                       description: Substitutions data for Build resource.
                                       type: object
+                                      x-kubernetes-map-type: granular
                                     tagName:
                                       description: Name of the tag to build. Exactly
                                         one of a branch name, tag, or commit SHA must
@@ -578,6 +580,7 @@ spec:
                             type: string
                           description: Substitutions data for Build resource.
                           type: object
+                          x-kubernetes-map-type: granular
                         tags:
                           description: Tags for annotation of a Build. These are not
                             docker tags.
@@ -1041,6 +1044,7 @@ spec:
                       type: string
                     description: Substitutions data for Build resource.
                     type: object
+                    x-kubernetes-map-type: granular
                   tags:
                     description: Tags for annotation of a BuildTrigger
                     items:
@@ -1498,6 +1502,7 @@ spec:
                                   crypto key. These values must be specified in the
                                   build's Secret.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         source:
@@ -1546,6 +1551,7 @@ spec:
                                         type: string
                                       description: Substitutions data for Build resource.
                                       type: object
+                                      x-kubernetes-map-type: granular
                                     tagName:
                                       description: Name of the tag to build. Exactly
                                         one of a branch name, tag, or commit SHA must
@@ -1706,6 +1712,7 @@ spec:
                             type: string
                           description: Substitutions data for Build resource.
                           type: object
+                          x-kubernetes-map-type: granular
                         tags:
                           description: Tags for annotation of a Build. These are not
                             docker tags.
@@ -2005,6 +2012,7 @@ spec:
                       type: string
                     description: Substitutions data for Build resource.
                     type: object
+                    x-kubernetes-map-type: granular
                   tags:
                     description: Tags for annotation of a BuildTrigger
                     items:
@@ -2553,6 +2561,7 @@ spec:
                                   crypto key. These values must be specified in the
                                   build's Secret.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         source:
@@ -2601,6 +2610,7 @@ spec:
                                         type: string
                                       description: Substitutions data for Build resource.
                                       type: object
+                                      x-kubernetes-map-type: granular
                                     tagName:
                                       description: Name of the tag to build. Exactly
                                         one of a branch name, tag, or commit SHA must
@@ -2761,6 +2771,7 @@ spec:
                             type: string
                           description: Substitutions data for Build resource.
                           type: object
+                          x-kubernetes-map-type: granular
                         tags:
                           description: Tags for annotation of a Build. These are not
                             docker tags.
@@ -3085,6 +3096,7 @@ spec:
                       type: string
                     description: Substitutions data for Build resource.
                     type: object
+                    x-kubernetes-map-type: granular
                   tags:
                     description: Tags for annotation of a BuildTrigger
                     items:
diff --git a/package/crds/cloudbuild.gcp.upbound.io_workerpools.yaml b/package/crds/cloudbuild.gcp.upbound.io_workerpools.yaml
index 917935533..250334fa1 100644
--- a/package/crds/cloudbuild.gcp.upbound.io_workerpools.yaml
+++ b/package/crds/cloudbuild.gcp.upbound.io_workerpools.yaml
@@ -71,6 +71,7 @@ spec:
                     additionalProperties:
                       type: string
                     type: object
+                    x-kubernetes-map-type: granular
                   displayName:
                     description: User-defined name of the WorkerPool.
                     type: string
@@ -226,6 +227,7 @@ spec:
                     additionalProperties:
                       type: string
                     type: object
+                    x-kubernetes-map-type: granular
                   displayName:
                     description: User-defined name of the WorkerPool.
                     type: string
@@ -442,6 +444,7 @@ spec:
                     additionalProperties:
                       type: string
                     type: object
+                    x-kubernetes-map-type: granular
                   createTime:
                     description: Output only. Time at which the request to create
                       the WorkerPool was received.
diff --git a/package/crds/cloudfunctions2.gcp.upbound.io_functions.yaml b/package/crds/cloudfunctions2.gcp.upbound.io_functions.yaml
index 9616dcfe6..4b9d60486 100644
--- a/package/crds/cloudfunctions2.gcp.upbound.io_functions.yaml
+++ b/package/crds/cloudfunctions2.gcp.upbound.io_functions.yaml
@@ -92,6 +92,7 @@ spec:
                           description: User-provided build-time environment variables
                             for the function.
                           type: object
+                          x-kubernetes-map-type: granular
                         runtime:
                           description: The runtime in which to run the function. Required
                             when deploying a new function, optional when updating
@@ -720,6 +721,7 @@ spec:
                     description: A set of key/value label pairs associated with this
                       Cloud Function.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The location of this cloud function.
                     type: string
@@ -751,6 +753,7 @@ spec:
                           description: Environment variables that shall be available
                             during function execution.
                           type: object
+                          x-kubernetes-map-type: granular
                         ingressSettings:
                           description: 'Available ingress settings. Defaults to "ALLOW_ALL"
                             if unspecified. Default value is ALLOW_ALL. Possible values
@@ -1147,6 +1150,7 @@ spec:
                           description: User-provided build-time environment variables
                             for the function.
                           type: object
+                          x-kubernetes-map-type: granular
                         runtime:
                           description: The runtime in which to run the function. Required
                             when deploying a new function, optional when updating
@@ -1267,6 +1271,7 @@ spec:
                     description: A set of key/value label pairs associated with this
                       Cloud Function.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -1295,6 +1300,7 @@ spec:
                           description: Environment variables that shall be available
                             during function execution.
                           type: object
+                          x-kubernetes-map-type: granular
                         ingressSettings:
                           description: 'Available ingress settings. Defaults to "ALLOW_ALL"
                             if unspecified. Default value is ALLOW_ALL. Possible values
@@ -1599,6 +1605,7 @@ spec:
                           description: User-provided build-time environment variables
                             for the function.
                           type: object
+                          x-kubernetes-map-type: granular
                         runtime:
                           description: The runtime in which to run the function. Required
                             when deploying a new function, optional when updating
@@ -1755,6 +1762,7 @@ spec:
                     description: A set of key/value label pairs associated with this
                       Cloud Function.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The location of this cloud function.
                     type: string
@@ -1786,6 +1794,7 @@ spec:
                           description: Environment variables that shall be available
                             during function execution.
                           type: object
+                          x-kubernetes-map-type: granular
                         gcfUri:
                           description: (Output) URIs of the Service deployed
                           type: string
diff --git a/package/crds/cloudiot.gcp.upbound.io_devices.yaml b/package/crds/cloudiot.gcp.upbound.io_devices.yaml
index 8e873d530..6d9cb029d 100644
--- a/package/crds/cloudiot.gcp.upbound.io_devices.yaml
+++ b/package/crds/cloudiot.gcp.upbound.io_devices.yaml
@@ -121,6 +121,7 @@ spec:
                       type: string
                     description: The metadata key-value pairs assigned to the device.
                     type: object
+                    x-kubernetes-map-type: granular
                   registry:
                     description: The name of the device registry where this device
                       should be created.
@@ -265,6 +266,7 @@ spec:
                       type: string
                     description: The metadata key-value pairs assigned to the device.
                     type: object
+                    x-kubernetes-map-type: granular
                 type: object
               managementPolicies:
                 default:
@@ -561,6 +563,7 @@ spec:
                       type: string
                     description: The metadata key-value pairs assigned to the device.
                     type: object
+                    x-kubernetes-map-type: granular
                   numId:
                     description: A server-defined unique numeric ID for the device.
                       This is a more compact way to identify devices, and it is globally
diff --git a/package/crds/cloudplatform.gcp.upbound.io_organizationiamauditconfigs.yaml b/package/crds/cloudplatform.gcp.upbound.io_organizationiamauditconfigs.yaml
index 2e80a9bbe..61625b3dc 100644
--- a/package/crds/cloudplatform.gcp.upbound.io_organizationiamauditconfigs.yaml
+++ b/package/crds/cloudplatform.gcp.upbound.io_organizationiamauditconfigs.yaml
@@ -75,6 +75,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         logType:
                           type: string
                       type: object
@@ -103,6 +104,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         logType:
                           type: string
                       type: object
@@ -298,6 +300,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         logType:
                           type: string
                       type: object
diff --git a/package/crds/cloudplatform.gcp.upbound.io_organizationiamcustomroles.yaml b/package/crds/cloudplatform.gcp.upbound.io_organizationiamcustomroles.yaml
index b0bcf9b16..07cd1b5d7 100644
--- a/package/crds/cloudplatform.gcp.upbound.io_organizationiamcustomroles.yaml
+++ b/package/crds/cloudplatform.gcp.upbound.io_organizationiamcustomroles.yaml
@@ -81,6 +81,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   roleId:
                     description: The role id to use for this role.
                     type: string
@@ -117,6 +118,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   roleId:
                     description: The role id to use for this role.
                     type: string
@@ -335,6 +337,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   roleId:
                     description: The role id to use for this role.
                     type: string
diff --git a/package/crds/cloudplatform.gcp.upbound.io_projectiamauditconfigs.yaml b/package/crds/cloudplatform.gcp.upbound.io_projectiamauditconfigs.yaml
index 7b872a790..baf06f712 100644
--- a/package/crds/cloudplatform.gcp.upbound.io_projectiamauditconfigs.yaml
+++ b/package/crds/cloudplatform.gcp.upbound.io_projectiamauditconfigs.yaml
@@ -74,6 +74,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         logType:
                           type: string
                       type: object
@@ -175,6 +176,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         logType:
                           type: string
                       type: object
@@ -364,6 +366,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         logType:
                           type: string
                       type: object
diff --git a/package/crds/cloudplatform.gcp.upbound.io_projectiamcustomroles.yaml b/package/crds/cloudplatform.gcp.upbound.io_projectiamcustomroles.yaml
index 7cb65836d..f382d04ff 100644
--- a/package/crds/cloudplatform.gcp.upbound.io_projectiamcustomroles.yaml
+++ b/package/crds/cloudplatform.gcp.upbound.io_projectiamcustomroles.yaml
@@ -76,6 +76,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   project:
                     description: The project that the service account will be created
                       in. Defaults to the provider project configuration.
@@ -109,6 +110,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   project:
                     description: The project that the service account will be created
                       in. Defaults to the provider project configuration.
@@ -316,6 +318,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   project:
                     description: The project that the service account will be created
                       in. Defaults to the provider project configuration.
diff --git a/package/crds/cloudplatform.gcp.upbound.io_projects.yaml b/package/crds/cloudplatform.gcp.upbound.io_projects.yaml
index 7ffc12181..dff028863 100644
--- a/package/crds/cloudplatform.gcp.upbound.io_projects.yaml
+++ b/package/crds/cloudplatform.gcp.upbound.io_projects.yaml
@@ -167,6 +167,7 @@ spec:
                       type: string
                     description: A set of key/value label pairs to assign to the project.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: The display name of the project.
                     type: string
@@ -216,6 +217,7 @@ spec:
                       type: string
                     description: A set of key/value label pairs to assign to the project.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: The display name of the project.
                     type: string
@@ -437,6 +439,7 @@ spec:
                       type: string
                     description: A set of key/value label pairs to assign to the project.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: The display name of the project.
                     type: string
diff --git a/package/crds/cloudrun.gcp.upbound.io_domainmappings.yaml b/package/crds/cloudrun.gcp.upbound.io_domainmappings.yaml
index c99cc4f32..87f0dbe7d 100644
--- a/package/crds/cloudrun.gcp.upbound.io_domainmappings.yaml
+++ b/package/crds/cloudrun.gcp.upbound.io_domainmappings.yaml
@@ -85,6 +85,7 @@ spec:
                             that were not provided in your config.ignore_changes rule
                             to the metadata.0.annotations field.'
                           type: object
+                          x-kubernetes-map-type: granular
                         labels:
                           additionalProperties:
                             type: string
@@ -93,6 +94,7 @@ spec:
                             May match selectors of replication controllers and routes.
                             More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels'
                           type: object
+                          x-kubernetes-map-type: granular
                         namespace:
                           description: In Cloud Run the namespace must be equal to
                             either the project ID or project number.
@@ -313,6 +315,7 @@ spec:
                             that were not provided in your config.ignore_changes rule
                             to the metadata.0.annotations field.'
                           type: object
+                          x-kubernetes-map-type: granular
                         labels:
                           additionalProperties:
                             type: string
@@ -321,6 +324,7 @@ spec:
                             May match selectors of replication controllers and routes.
                             More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels'
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   name:
@@ -552,6 +556,7 @@ spec:
                             that were not provided in your config.ignore_changes rule
                             to the metadata.0.annotations field.'
                           type: object
+                          x-kubernetes-map-type: granular
                         generation:
                           description: (Output) A sequence number representing a specific
                             generation of the desired state.
@@ -564,6 +569,7 @@ spec:
                             May match selectors of replication controllers and routes.
                             More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels'
                           type: object
+                          x-kubernetes-map-type: granular
                         namespace:
                           description: In Cloud Run the namespace must be equal to
                             either the project ID or project number.
diff --git a/package/crds/cloudrun.gcp.upbound.io_services.yaml b/package/crds/cloudrun.gcp.upbound.io_services.yaml
index 12c8ab984..b9562db0b 100644
--- a/package/crds/cloudrun.gcp.upbound.io_services.yaml
+++ b/package/crds/cloudrun.gcp.upbound.io_services.yaml
@@ -101,12 +101,14 @@ spec:
                             Use the following annotation keys to configure features
                             on a Revision template:'
                           type: object
+                          x-kubernetes-map-type: granular
                         labels:
                           additionalProperties:
                             type: string
                           description: Map of string keys and values that can be used
                             to organize and categorize (scope and select) objects.
                           type: object
+                          x-kubernetes-map-type: granular
                         namespace:
                           description: In Cloud Run the namespace must be equal to
                             either the project ID or project number. It will default
@@ -234,6 +236,7 @@ spec:
                                   are restricted. Use the following annotation keys
                                   to configure features on a Revision template:'
                                 type: object
+                                x-kubernetes-map-type: granular
                               labels:
                                 additionalProperties:
                                   type: string
@@ -241,6 +244,7 @@ spec:
                                   be used to organize and categorize (scope and select)
                                   objects.
                                 type: object
+                                x-kubernetes-map-type: granular
                               name:
                                 description: Volume's name.
                                 type: string
@@ -632,6 +636,7 @@ spec:
                                               The values of the map is string form
                                               of the ''quantity'' k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go'
                                             type: object
+                                            x-kubernetes-map-type: granular
                                           requests:
                                             additionalProperties:
                                               type: string
@@ -643,6 +648,7 @@ spec:
                                               value. The values of the map is string
                                               form of the ''quantity'' k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go'
                                             type: object
+                                            x-kubernetes-map-type: granular
                                         type: object
                                       type: array
                                     startupProbe:
@@ -1043,12 +1049,14 @@ spec:
                             Use the following annotation keys to configure features
                             on a Revision template:'
                           type: object
+                          x-kubernetes-map-type: granular
                         labels:
                           additionalProperties:
                             type: string
                           description: Map of string keys and values that can be used
                             to organize and categorize (scope and select) objects.
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   project:
@@ -1093,6 +1101,7 @@ spec:
                                   are restricted. Use the following annotation keys
                                   to configure features on a Revision template:'
                                 type: object
+                                x-kubernetes-map-type: granular
                               labels:
                                 additionalProperties:
                                   type: string
@@ -1100,6 +1109,7 @@ spec:
                                   be used to organize and categorize (scope and select)
                                   objects.
                                 type: object
+                                x-kubernetes-map-type: granular
                               name:
                                 description: Volume's name.
                                 type: string
@@ -1374,6 +1384,7 @@ spec:
                                               The values of the map is string form
                                               of the ''quantity'' k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go'
                                             type: object
+                                            x-kubernetes-map-type: granular
                                           requests:
                                             additionalProperties:
                                               type: string
@@ -1385,6 +1396,7 @@ spec:
                                               value. The values of the map is string
                                               form of the ''quantity'' k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go'
                                             type: object
+                                            x-kubernetes-map-type: granular
                                         type: object
                                       type: array
                                     startupProbe:
@@ -1840,6 +1852,7 @@ spec:
                             Use the following annotation keys to configure features
                             on a Revision template:'
                           type: object
+                          x-kubernetes-map-type: granular
                         generation:
                           description: (Output) A sequence number representing a specific
                             generation of the desired state.
@@ -1850,6 +1863,7 @@ spec:
                           description: Map of string keys and values that can be used
                             to organize and categorize (scope and select) objects.
                           type: object
+                          x-kubernetes-map-type: granular
                         namespace:
                           description: In Cloud Run the namespace must be equal to
                             either the project ID or project number. It will default
@@ -2005,6 +2019,7 @@ spec:
                                   are restricted. Use the following annotation keys
                                   to configure features on a Revision template:'
                                 type: object
+                                x-kubernetes-map-type: granular
                               generation:
                                 description: (Output) A sequence number representing
                                   a specific generation of the desired state.
@@ -2016,6 +2031,7 @@ spec:
                                   be used to organize and categorize (scope and select)
                                   objects.
                                 type: object
+                                x-kubernetes-map-type: granular
                               name:
                                 description: Volume's name.
                                 type: string
@@ -2311,6 +2327,7 @@ spec:
                                               The values of the map is string form
                                               of the ''quantity'' k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go'
                                             type: object
+                                            x-kubernetes-map-type: granular
                                           requests:
                                             additionalProperties:
                                               type: string
@@ -2322,6 +2339,7 @@ spec:
                                               value. The values of the map is string
                                               form of the ''quantity'' k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go'
                                             type: object
+                                            x-kubernetes-map-type: granular
                                         type: object
                                       type: array
                                     startupProbe:
diff --git a/package/crds/cloudrun.gcp.upbound.io_v2jobs.yaml b/package/crds/cloudrun.gcp.upbound.io_v2jobs.yaml
index 00a4ea561..aeeb98e66 100644
--- a/package/crds/cloudrun.gcp.upbound.io_v2jobs.yaml
+++ b/package/crds/cloudrun.gcp.upbound.io_v2jobs.yaml
@@ -79,6 +79,7 @@ spec:
                       in v1 now have a corresponding field in v2 Job. This field follows
                       Kubernetes annotations' namespacing, limits, and rules.
                     type: object
+                    x-kubernetes-map-type: granular
                   binaryAuthorization:
                     description: Settings for the Binary Authorization feature. Structure
                       is documented below.
@@ -116,6 +117,7 @@ spec:
                       namespaces, and they will be rejected. All system labels in
                       v1 now have a corresponding field in v2 Job.
                     type: object
+                    x-kubernetes-map-type: granular
                   launchStage:
                     description: 'The launch stage as defined by Google Cloud Platform
                       Launch Stages. Cloud Run supports ALPHA, BETA, and GA. If no
@@ -152,6 +154,7 @@ spec:
                             field in v2 ExecutionTemplate. This field follows Kubernetes
                             annotations' namespacing, limits, and rules.
                           type: object
+                          x-kubernetes-map-type: granular
                         labels:
                           additionalProperties:
                             type: string
@@ -167,6 +170,7 @@ spec:
                             namespaces, and they will be rejected. All system labels
                             in v1 now have a corresponding field in v2 ExecutionTemplate.
                           type: object
+                          x-kubernetes-map-type: granular
                         parallelism:
                           description: Specifies the maximum desired number of tasks
                             the execution should run at given time. Must be <= taskCount.
@@ -514,6 +518,7 @@ spec:
                                               map is string form of the ''quantity''
                                               k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go'
                                             type: object
+                                            x-kubernetes-map-type: granular
                                         type: object
                                       type: array
                                     startupProbe:
@@ -882,6 +887,7 @@ spec:
                       in v1 now have a corresponding field in v2 Job. This field follows
                       Kubernetes annotations' namespacing, limits, and rules.
                     type: object
+                    x-kubernetes-map-type: granular
                   binaryAuthorization:
                     description: Settings for the Binary Authorization feature. Structure
                       is documented below.
@@ -919,6 +925,7 @@ spec:
                       namespaces, and they will be rejected. All system labels in
                       v1 now have a corresponding field in v2 Job.
                     type: object
+                    x-kubernetes-map-type: granular
                   launchStage:
                     description: 'The launch stage as defined by Google Cloud Platform
                       Launch Stages. Cloud Run supports ALPHA, BETA, and GA. If no
@@ -952,6 +959,7 @@ spec:
                             field in v2 ExecutionTemplate. This field follows Kubernetes
                             annotations' namespacing, limits, and rules.
                           type: object
+                          x-kubernetes-map-type: granular
                         labels:
                           additionalProperties:
                             type: string
@@ -967,6 +975,7 @@ spec:
                             namespaces, and they will be rejected. All system labels
                             in v1 now have a corresponding field in v2 ExecutionTemplate.
                           type: object
+                          x-kubernetes-map-type: granular
                         parallelism:
                           description: Specifies the maximum desired number of tasks
                             the execution should run at given time. Must be <= taskCount.
@@ -1192,6 +1201,7 @@ spec:
                                               map is string form of the ''quantity''
                                               k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go'
                                             type: object
+                                            x-kubernetes-map-type: granular
                                         type: object
                                       type: array
                                     startupProbe:
@@ -1622,6 +1632,7 @@ spec:
                       in v1 now have a corresponding field in v2 Job. This field follows
                       Kubernetes annotations' namespacing, limits, and rules.
                     type: object
+                    x-kubernetes-map-type: granular
                   binaryAuthorization:
                     description: Settings for the Binary Authorization feature. Structure
                       is documented below.
@@ -1718,6 +1729,7 @@ spec:
                       namespaces, and they will be rejected. All system labels in
                       v1 now have a corresponding field in v2 Job.
                     type: object
+                    x-kubernetes-map-type: granular
                   latestCreatedExecution:
                     description: Name of the last created execution. Structure is
                       documented below.
@@ -1801,6 +1813,7 @@ spec:
                             field in v2 ExecutionTemplate. This field follows Kubernetes
                             annotations' namespacing, limits, and rules.
                           type: object
+                          x-kubernetes-map-type: granular
                         labels:
                           additionalProperties:
                             type: string
@@ -1816,6 +1829,7 @@ spec:
                             namespaces, and they will be rejected. All system labels
                             in v1 now have a corresponding field in v2 ExecutionTemplate.
                           type: object
+                          x-kubernetes-map-type: granular
                         parallelism:
                           description: Specifies the maximum desired number of tasks
                             the execution should run at given time. Must be <= taskCount.
@@ -2049,6 +2063,7 @@ spec:
                                               map is string form of the ''quantity''
                                               k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go'
                                             type: object
+                                            x-kubernetes-map-type: granular
                                         type: object
                                       type: array
                                     startupProbe:
diff --git a/package/crds/cloudrun.gcp.upbound.io_v2services.yaml b/package/crds/cloudrun.gcp.upbound.io_v2services.yaml
index 554f99e83..751f3a171 100644
--- a/package/crds/cloudrun.gcp.upbound.io_v2services.yaml
+++ b/package/crds/cloudrun.gcp.upbound.io_v2services.yaml
@@ -80,6 +80,7 @@ spec:
                       have a corresponding field in v2 RevisionTemplate. This field
                       follows Kubernetes annotations' namespacing, limits, and rules.
                     type: object
+                    x-kubernetes-map-type: granular
                   binaryAuthorization:
                     description: Settings for the Binary Authorization feature. Structure
                       is documented below.
@@ -128,6 +129,7 @@ spec:
                       namespaces, and they will be rejected. All system labels in
                       v1 now have a corresponding field in v2 RevisionTemplate.
                     type: object
+                    x-kubernetes-map-type: granular
                   launchStage:
                     description: 'The launch stage as defined by Google Cloud Platform
                       Launch Stages. Cloud Run supports ALPHA, BETA, and GA. If no
@@ -164,6 +166,7 @@ spec:
                             field in v2 RevisionTemplate. This field follows Kubernetes
                             annotations' namespacing, limits, and rules.
                           type: object
+                          x-kubernetes-map-type: granular
                         containers:
                           description: Holds the containers that define the unit of
                             execution for this Service. Structure is documented below.
@@ -489,6 +492,7 @@ spec:
                                         of the map is string form of the ''quantity''
                                         k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go'
                                       type: object
+                                      x-kubernetes-map-type: granular
                                     startupCpuBoost:
                                       description: Determines whether CPU should be
                                         boosted on startup of a new container instance
@@ -655,6 +659,7 @@ spec:
                             namespaces, and they will be rejected. All system labels
                             in v1 now have a corresponding field in v2 RevisionTemplate.
                           type: object
+                          x-kubernetes-map-type: granular
                         maxInstanceRequestConcurrency:
                           description: Sets the maximum number of requests that each
                             serving instance can receive.
@@ -926,6 +931,7 @@ spec:
                       have a corresponding field in v2 RevisionTemplate. This field
                       follows Kubernetes annotations' namespacing, limits, and rules.
                     type: object
+                    x-kubernetes-map-type: granular
                   binaryAuthorization:
                     description: Settings for the Binary Authorization feature. Structure
                       is documented below.
@@ -974,6 +980,7 @@ spec:
                       namespaces, and they will be rejected. All system labels in
                       v1 now have a corresponding field in v2 RevisionTemplate.
                     type: object
+                    x-kubernetes-map-type: granular
                   launchStage:
                     description: 'The launch stage as defined by Google Cloud Platform
                       Launch Stages. Cloud Run supports ALPHA, BETA, and GA. If no
@@ -1007,6 +1014,7 @@ spec:
                             field in v2 RevisionTemplate. This field follows Kubernetes
                             annotations' namespacing, limits, and rules.
                           type: object
+                          x-kubernetes-map-type: granular
                         containers:
                           description: Holds the containers that define the unit of
                             execution for this Service. Structure is documented below.
@@ -1226,6 +1234,7 @@ spec:
                                         of the map is string form of the ''quantity''
                                         k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go'
                                       type: object
+                                      x-kubernetes-map-type: granular
                                     startupCpuBoost:
                                       description: Determines whether CPU should be
                                         boosted on startup of a new container instance
@@ -1392,6 +1401,7 @@ spec:
                             namespaces, and they will be rejected. All system labels
                             in v1 now have a corresponding field in v2 RevisionTemplate.
                           type: object
+                          x-kubernetes-map-type: granular
                         maxInstanceRequestConcurrency:
                           description: Sets the maximum number of requests that each
                             serving instance can receive.
@@ -1732,6 +1742,7 @@ spec:
                       have a corresponding field in v2 RevisionTemplate. This field
                       follows Kubernetes annotations' namespacing, limits, and rules.
                     type: object
+                    x-kubernetes-map-type: granular
                   binaryAuthorization:
                     description: Settings for the Binary Authorization feature. Structure
                       is documented below.
@@ -1838,6 +1849,7 @@ spec:
                       namespaces, and they will be rejected. All system labels in
                       v1 now have a corresponding field in v2 RevisionTemplate.
                     type: object
+                    x-kubernetes-map-type: granular
                   latestCreatedRevision:
                     description: Name of the last created revision. See comments in
                       reconciling for additional information on reconciliation process
@@ -1911,6 +1923,7 @@ spec:
                             field in v2 RevisionTemplate. This field follows Kubernetes
                             annotations' namespacing, limits, and rules.
                           type: object
+                          x-kubernetes-map-type: granular
                         containers:
                           description: Holds the containers that define the unit of
                             execution for this Service. Structure is documented below.
@@ -2136,6 +2149,7 @@ spec:
                                         of the map is string form of the ''quantity''
                                         k8s type: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go'
                                       type: object
+                                      x-kubernetes-map-type: granular
                                     startupCpuBoost:
                                       description: Determines whether CPU should be
                                         boosted on startup of a new container instance
@@ -2302,6 +2316,7 @@ spec:
                             namespaces, and they will be rejected. All system labels
                             in v1 now have a corresponding field in v2 RevisionTemplate.
                           type: object
+                          x-kubernetes-map-type: granular
                         maxInstanceRequestConcurrency:
                           description: Sets the maximum number of requests that each
                             serving instance can receive.
diff --git a/package/crds/cloudscheduler.gcp.upbound.io_jobs.yaml b/package/crds/cloudscheduler.gcp.upbound.io_jobs.yaml
index 752477136..cdc805b98 100644
--- a/package/crds/cloudscheduler.gcp.upbound.io_jobs.yaml
+++ b/package/crds/cloudscheduler.gcp.upbound.io_jobs.yaml
@@ -109,6 +109,7 @@ spec:
                             header field names and values. Headers can be set when
                             the job is created.
                           type: object
+                          x-kubernetes-map-type: granular
                         httpMethod:
                           description: Which HTTP method to use for the request.
                           type: string
@@ -153,6 +154,7 @@ spec:
                             values. Repeated headers are not supported, but a header
                             value can contain commas.
                           type: object
+                          x-kubernetes-map-type: granular
                         httpMethod:
                           description: Which HTTP method to use for the request.
                           type: string
@@ -220,6 +222,7 @@ spec:
                           description: Attributes for PubsubMessage. Pubsub message
                             must contain either non-empty data, or at least one attribute.
                           type: object
+                          x-kubernetes-map-type: granular
                         data:
                           description: The message payload for PubsubMessage. Pubsub
                             message must contain either non-empty data, or at least
@@ -418,6 +421,7 @@ spec:
                             header field names and values. Headers can be set when
                             the job is created.
                           type: object
+                          x-kubernetes-map-type: granular
                         httpMethod:
                           description: Which HTTP method to use for the request.
                           type: string
@@ -462,6 +466,7 @@ spec:
                             values. Repeated headers are not supported, but a header
                             value can contain commas.
                           type: object
+                          x-kubernetes-map-type: granular
                         httpMethod:
                           description: Which HTTP method to use for the request.
                           type: string
@@ -529,6 +534,7 @@ spec:
                           description: Attributes for PubsubMessage. Pubsub message
                             must contain either non-empty data, or at least one attribute.
                           type: object
+                          x-kubernetes-map-type: granular
                         data:
                           description: The message payload for PubsubMessage. Pubsub
                             message must contain either non-empty data, or at least
@@ -790,6 +796,7 @@ spec:
                             header field names and values. Headers can be set when
                             the job is created.
                           type: object
+                          x-kubernetes-map-type: granular
                         httpMethod:
                           description: Which HTTP method to use for the request.
                           type: string
@@ -834,6 +841,7 @@ spec:
                             values. Repeated headers are not supported, but a header
                             value can contain commas.
                           type: object
+                          x-kubernetes-map-type: granular
                         httpMethod:
                           description: Which HTTP method to use for the request.
                           type: string
@@ -904,6 +912,7 @@ spec:
                           description: Attributes for PubsubMessage. Pubsub message
                             must contain either non-empty data, or at least one attribute.
                           type: object
+                          x-kubernetes-map-type: granular
                         data:
                           description: The message payload for PubsubMessage. Pubsub
                             message must contain either non-empty data, or at least
diff --git a/package/crds/composer.gcp.upbound.io_environments.yaml b/package/crds/composer.gcp.upbound.io_environments.yaml
index afb3e07e8..22e5d99ea 100644
--- a/package/crds/composer.gcp.upbound.io_environments.yaml
+++ b/package/crds/composer.gcp.upbound.io_environments.yaml
@@ -341,6 +341,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               serviceAccount:
                                 description: The Google Cloud Platform Service Account
                                   to be used by the node VMs. If a service account
@@ -526,6 +527,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               zone:
                                 description: The Compute Engine zone in which to deploy
                                   the VMs running the Apache Airflow software, specified
@@ -642,6 +644,7 @@ spec:
                                   property names, separated by a hyphen, for example
                                   "core-dags_are_paused_at_creation".
                                 type: object
+                                x-kubernetes-map-type: granular
                               envVariables:
                                 additionalProperties:
                                   type: string
@@ -654,6 +657,7 @@ spec:
                                   AIRFLOW__[A-Z0-9_]+__[A-Z0-9_]+), and they cannot
                                   match any of the following reserved names:'
                                 type: object
+                                x-kubernetes-map-type: granular
                               imageVersion:
                                 type: string
                               pypiPackages:
@@ -668,6 +672,7 @@ spec:
                                   to a version specifier, use the empty string as
                                   the value.
                                 type: object
+                                x-kubernetes-map-type: granular
                               pythonVersion:
                                 description: The major version of Python used to run
                                   the Apache Airflow scheduler, worker, and webserver
@@ -818,6 +823,7 @@ spec:
                       No more than 64 labels can be associated with a given environment.
                       Both keys and values must be <= 128 bytes in size.'
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -1103,6 +1109,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               tags:
                                 description: The list of instance tags applied to
                                   all node VMs. Tags are used to identify valid sources
@@ -1111,6 +1118,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               zone:
                                 description: The Compute Engine zone in which to deploy
                                   the VMs running the Apache Airflow software, specified
@@ -1227,6 +1235,7 @@ spec:
                                   property names, separated by a hyphen, for example
                                   "core-dags_are_paused_at_creation".
                                 type: object
+                                x-kubernetes-map-type: granular
                               envVariables:
                                 additionalProperties:
                                   type: string
@@ -1239,6 +1248,7 @@ spec:
                                   AIRFLOW__[A-Z0-9_]+__[A-Z0-9_]+), and they cannot
                                   match any of the following reserved names:'
                                 type: object
+                                x-kubernetes-map-type: granular
                               imageVersion:
                                 type: string
                               pypiPackages:
@@ -1253,6 +1263,7 @@ spec:
                                   to a version specifier, use the empty string as
                                   the value.
                                 type: object
+                                x-kubernetes-map-type: granular
                               pythonVersion:
                                 description: The major version of Python used to run
                                   the Apache Airflow scheduler, worker, and webserver
@@ -1403,6 +1414,7 @@ spec:
                       No more than 64 labels can be associated with a given environment.
                       Both keys and values must be <= 128 bytes in size.'
                     type: object
+                    x-kubernetes-map-type: granular
                 type: object
               managementPolicies:
                 default:
@@ -1779,6 +1791,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               serviceAccount:
                                 description: The Google Cloud Platform Service Account
                                   to be used by the node VMs. If a service account
@@ -1804,6 +1817,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               zone:
                                 description: The Compute Engine zone in which to deploy
                                   the VMs running the Apache Airflow software, specified
@@ -1920,6 +1934,7 @@ spec:
                                   property names, separated by a hyphen, for example
                                   "core-dags_are_paused_at_creation".
                                 type: object
+                                x-kubernetes-map-type: granular
                               envVariables:
                                 additionalProperties:
                                   type: string
@@ -1932,6 +1947,7 @@ spec:
                                   AIRFLOW__[A-Z0-9_]+__[A-Z0-9_]+), and they cannot
                                   match any of the following reserved names:'
                                 type: object
+                                x-kubernetes-map-type: granular
                               imageVersion:
                                 type: string
                               pypiPackages:
@@ -1946,6 +1962,7 @@ spec:
                                   to a version specifier, use the empty string as
                                   the value.
                                 type: object
+                                x-kubernetes-map-type: granular
                               pythonVersion:
                                 description: The major version of Python used to run
                                   the Apache Airflow scheduler, worker, and webserver
@@ -2099,6 +2116,7 @@ spec:
                       No more than 64 labels can be associated with a given environment.
                       Both keys and values must be <= 128 bytes in size.'
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
diff --git a/package/crds/compute.gcp.upbound.io_backendservices.yaml b/package/crds/compute.gcp.upbound.io_backendservices.yaml
index 246ec4bd1..543eacad6 100644
--- a/package/crds/compute.gcp.upbound.io_backendservices.yaml
+++ b/package/crds/compute.gcp.upbound.io_backendservices.yaml
@@ -308,6 +308,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               queryStringWhitelist:
                                 description: Names of query string parameters to include
                                   in cache keys. All other parameters will be excluded.
@@ -317,6 +318,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                         cacheMode:
@@ -504,12 +506,14 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   customResponseHeaders:
                     description: Headers that the HTTP/S load balancer should add
                       to proxied responses.
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   description:
                     description: An optional description of this resource.
                     type: string
@@ -530,6 +534,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   healthChecksRefs:
                     description: References to HealthCheck to populate healthChecks.
                     items:
@@ -1047,6 +1052,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               queryStringWhitelist:
                                 description: Names of query string parameters to include
                                   in cache keys. All other parameters will be excluded.
@@ -1056,6 +1062,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                         cacheMode:
@@ -1243,12 +1250,14 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   customResponseHeaders:
                     description: Headers that the HTTP/S load balancer should add
                       to proxied responses.
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   description:
                     description: An optional description of this resource.
                     type: string
@@ -1849,6 +1858,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               queryStringWhitelist:
                                 description: Names of query string parameters to include
                                   in cache keys. All other parameters will be excluded.
@@ -1858,6 +1868,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                         cacheMode:
@@ -2048,12 +2059,14 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   customResponseHeaders:
                     description: Headers that the HTTP/S load balancer should add
                       to proxied responses.
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   description:
                     description: An optional description of this resource.
                     type: string
@@ -2082,6 +2095,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   iap:
                     description: Settings for enabling Cloud Identity Aware Proxy
                       Structure is documented below.
diff --git a/package/crds/compute.gcp.upbound.io_disks.yaml b/package/crds/compute.gcp.upbound.io_disks.yaml
index 885cf69cd..d043f5b58 100644
--- a/package/crds/compute.gcp.upbound.io_disks.yaml
+++ b/package/crds/compute.gcp.upbound.io_disks.yaml
@@ -262,6 +262,7 @@ spec:
                     description: Labels to apply to this disk.  A list of key->value
                       pairs.
                     type: object
+                    x-kubernetes-map-type: granular
                   licenses:
                     description: Any applicable license URI.
                     items:
@@ -460,6 +461,7 @@ spec:
                     description: Labels to apply to this disk.  A list of key->value
                       pairs.
                     type: object
+                    x-kubernetes-map-type: granular
                   licenses:
                     description: Any applicable license URI.
                     items:
@@ -825,6 +827,7 @@ spec:
                     description: Labels to apply to this disk.  A list of key->value
                       pairs.
                     type: object
+                    x-kubernetes-map-type: granular
                   lastAttachTimestamp:
                     description: Last attach timestamp in RFC3339 text format.
                     type: string
diff --git a/package/crds/compute.gcp.upbound.io_externalvpngateways.yaml b/package/crds/compute.gcp.upbound.io_externalvpngateways.yaml
index 70591daae..6c666105d 100644
--- a/package/crds/compute.gcp.upbound.io_externalvpngateways.yaml
+++ b/package/crds/compute.gcp.upbound.io_externalvpngateways.yaml
@@ -94,6 +94,7 @@ spec:
                       type: string
                     description: Labels for the external VPN gateway resource.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -143,6 +144,7 @@ spec:
                       type: string
                     description: Labels for the external VPN gateway resource.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -352,6 +354,7 @@ spec:
                       type: string
                     description: Labels for the external VPN gateway resource.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
diff --git a/package/crds/compute.gcp.upbound.io_firewalls.yaml b/package/crds/compute.gcp.upbound.io_firewalls.yaml
index 4a760d0a1..da7c9efae 100644
--- a/package/crds/compute.gcp.upbound.io_firewalls.yaml
+++ b/package/crds/compute.gcp.upbound.io_firewalls.yaml
@@ -129,6 +129,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   direction:
                     description: 'Direction of traffic to which this firewall applies;
                       default is INGRESS. Note: For INGRESS traffic, one of source_ranges,
@@ -264,6 +265,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   sourceServiceAccounts:
                     description: If source service accounts are specified, the firewall
                       will apply only to traffic originating from an instance with
@@ -282,6 +284,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   sourceTags:
                     description: If source tags are specified, the firewall will apply
                       only to traffic with source IP that belongs to a tag listed
@@ -297,6 +300,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   targetServiceAccounts:
                     description: A list of service accounts indicating sets of instances
                       located in the network that may make network connections as
@@ -307,6 +311,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   targetTags:
                     description: A list of instance tags indicating sets of instances
                       located in the network that may make network connections as
@@ -315,6 +320,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                 type: object
               initProvider:
                 description: THIS IS A BETA FIELD. It will be honored unless the Management
@@ -390,6 +396,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   direction:
                     description: 'Direction of traffic to which this firewall applies;
                       default is INGRESS. Note: For INGRESS traffic, one of source_ranges,
@@ -448,6 +455,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   sourceServiceAccounts:
                     description: If source service accounts are specified, the firewall
                       will apply only to traffic originating from an instance with
@@ -466,6 +474,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   sourceTags:
                     description: If source tags are specified, the firewall will apply
                       only to traffic with source IP that belongs to a tag listed
@@ -481,6 +490,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   targetServiceAccounts:
                     description: A list of service accounts indicating sets of instances
                       located in the network that may make network connections as
@@ -491,6 +501,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   targetTags:
                     description: A list of instance tags indicating sets of instances
                       located in the network that may make network connections as
@@ -499,6 +510,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                 type: object
               managementPolicies:
                 default:
@@ -730,6 +742,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   direction:
                     description: 'Direction of traffic to which this firewall applies;
                       default is INGRESS. Note: For INGRESS traffic, one of source_ranges,
@@ -798,6 +811,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   sourceServiceAccounts:
                     description: If source service accounts are specified, the firewall
                       will apply only to traffic originating from an instance with
@@ -816,6 +830,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   sourceTags:
                     description: If source tags are specified, the firewall will apply
                       only to traffic with source IP that belongs to a tag listed
@@ -831,6 +846,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   targetServiceAccounts:
                     description: A list of service accounts indicating sets of instances
                       located in the network that may make network connections as
@@ -841,6 +857,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   targetTags:
                     description: A list of instance tags indicating sets of instances
                       located in the network that may make network connections as
@@ -849,6 +866,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                 type: object
               conditions:
                 description: Conditions of the resource.
diff --git a/package/crds/compute.gcp.upbound.io_forwardingrules.yaml b/package/crds/compute.gcp.upbound.io_forwardingrules.yaml
index dc6fa2db3..d3c85333f 100644
--- a/package/crds/compute.gcp.upbound.io_forwardingrules.yaml
+++ b/package/crds/compute.gcp.upbound.io_forwardingrules.yaml
@@ -266,6 +266,7 @@ spec:
                     description: Labels to apply to this forwarding rule.  A list
                       of key->value pairs.
                     type: object
+                    x-kubernetes-map-type: granular
                   loadBalancingScheme:
                     description: 'Specifies the forwarding rule type. For more information
                       about forwarding rules, refer to Forwarding rule concepts. Default
@@ -383,6 +384,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -646,6 +648,7 @@ spec:
                     description: Labels to apply to this forwarding rule.  A list
                       of key->value pairs.
                     type: object
+                    x-kubernetes-map-type: granular
                   loadBalancingScheme:
                     description: 'Specifies the forwarding rule type. For more information
                       about forwarding rules, refer to Forwarding rule concepts. Default
@@ -680,6 +683,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -959,6 +963,7 @@ spec:
                     description: Labels to apply to this forwarding rule.  A list
                       of key->value pairs.
                     type: object
+                    x-kubernetes-map-type: granular
                   loadBalancingScheme:
                     description: 'Specifies the forwarding rule type. For more information
                       about forwarding rules, refer to Forwarding rule concepts. Default
@@ -1003,6 +1008,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
diff --git a/package/crds/compute.gcp.upbound.io_globalforwardingrules.yaml b/package/crds/compute.gcp.upbound.io_globalforwardingrules.yaml
index 1c08cc70d..174170773 100644
--- a/package/crds/compute.gcp.upbound.io_globalforwardingrules.yaml
+++ b/package/crds/compute.gcp.upbound.io_globalforwardingrules.yaml
@@ -170,6 +170,7 @@ spec:
                     description: Labels to apply to this forwarding rule.  A list
                       of key->value pairs.
                     type: object
+                    x-kubernetes-map-type: granular
                   loadBalancingScheme:
                     description: 'Specifies the forwarding rule type. For more information
                       about forwarding rules, refer to Forwarding rule concepts. Default
@@ -528,6 +529,7 @@ spec:
                     description: Labels to apply to this forwarding rule.  A list
                       of key->value pairs.
                     type: object
+                    x-kubernetes-map-type: granular
                   loadBalancingScheme:
                     description: 'Specifies the forwarding rule type. For more information
                       about forwarding rules, refer to Forwarding rule concepts. Default
@@ -819,6 +821,7 @@ spec:
                     description: Labels to apply to this forwarding rule.  A list
                       of key->value pairs.
                     type: object
+                    x-kubernetes-map-type: granular
                   loadBalancingScheme:
                     description: 'Specifies the forwarding rule type. For more information
                       about forwarding rules, refer to Forwarding rule concepts. Default
diff --git a/package/crds/compute.gcp.upbound.io_images.yaml b/package/crds/compute.gcp.upbound.io_images.yaml
index 7f4aa085d..9394799b5 100644
--- a/package/crds/compute.gcp.upbound.io_images.yaml
+++ b/package/crds/compute.gcp.upbound.io_images.yaml
@@ -120,6 +120,7 @@ spec:
                       type: string
                     description: Labels to apply to this Image.
                     type: object
+                    x-kubernetes-map-type: granular
                   licenses:
                     description: Any applicable license URI.
                     items:
@@ -241,6 +242,7 @@ spec:
                       type: string
                     description: Labels to apply to this Image.
                     type: object
+                    x-kubernetes-map-type: granular
                   licenses:
                     description: Any applicable license URI.
                     items:
@@ -529,6 +531,7 @@ spec:
                       type: string
                     description: Labels to apply to this Image.
                     type: object
+                    x-kubernetes-map-type: granular
                   licenses:
                     description: Any applicable license URI.
                     items:
diff --git a/package/crds/compute.gcp.upbound.io_instancefromtemplates.yaml b/package/crds/compute.gcp.upbound.io_instancefromtemplates.yaml
index eaa279291..5d7bb1361 100644
--- a/package/crds/compute.gcp.upbound.io_instancefromtemplates.yaml
+++ b/package/crds/compute.gcp.upbound.io_instancefromtemplates.yaml
@@ -141,6 +141,7 @@ spec:
                                 additionalProperties:
                                   type: string
                                 type: object
+                                x-kubernetes-map-type: granular
                               size:
                                 type: number
                               type:
@@ -189,6 +190,7 @@ spec:
                     additionalProperties:
                       type: string
                     type: object
+                    x-kubernetes-map-type: granular
                   machineType:
                     type: string
                   metadata:
@@ -435,6 +437,7 @@ spec:
                           additionalProperties:
                             type: string
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   project:
@@ -490,6 +493,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                         onHostMaintenance:
@@ -518,6 +522,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   shieldedInstanceConfig:
@@ -613,6 +618,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   zone:
                     description: The zone that the machine should be created in. If
                       not set, the provider zone is used.
@@ -686,6 +692,7 @@ spec:
                                 additionalProperties:
                                   type: string
                                 type: object
+                                x-kubernetes-map-type: granular
                               size:
                                 type: number
                               type:
@@ -734,6 +741,7 @@ spec:
                     additionalProperties:
                       type: string
                     type: object
+                    x-kubernetes-map-type: granular
                   machineType:
                     type: string
                   metadata:
@@ -824,6 +832,7 @@ spec:
                           additionalProperties:
                             type: string
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   project:
@@ -879,6 +888,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                         onHostMaintenance:
@@ -907,6 +917,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   shieldedInstanceConfig:
@@ -924,6 +935,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   zone:
                     description: The zone that the machine should be created in. If
                       not set, the provider zone is used.
@@ -1158,6 +1170,7 @@ spec:
                                 additionalProperties:
                                   type: string
                                 type: object
+                                x-kubernetes-map-type: granular
                               size:
                                 type: number
                               type:
@@ -1216,6 +1229,7 @@ spec:
                     additionalProperties:
                       type: string
                     type: object
+                    x-kubernetes-map-type: granular
                   machineType:
                     type: string
                   metadata:
@@ -1318,6 +1332,7 @@ spec:
                           additionalProperties:
                             type: string
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   project:
@@ -1373,6 +1388,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                         onHostMaintenance:
@@ -1403,6 +1419,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   shieldedInstanceConfig:
@@ -1425,6 +1442,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   tagsFingerprint:
                     type: string
                   zone:
diff --git a/package/crds/compute.gcp.upbound.io_instancegroupmanagers.yaml b/package/crds/compute.gcp.upbound.io_instancegroupmanagers.yaml
index f78f8e609..7d5b25f4f 100644
--- a/package/crds/compute.gcp.upbound.io_instancegroupmanagers.yaml
+++ b/package/crds/compute.gcp.upbound.io_instancegroupmanagers.yaml
@@ -238,6 +238,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   targetPoolsRefs:
                     description: References to TargetPool to populate targetPools.
                     items:
@@ -1083,6 +1084,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   targetSize:
                     description: The target number of running instances for this managed
                       instance group. This value should always be explicitly set unless
diff --git a/package/crds/compute.gcp.upbound.io_instancegroups.yaml b/package/crds/compute.gcp.upbound.io_instancegroups.yaml
index 2fd6b0db7..090a4aa01 100644
--- a/package/crds/compute.gcp.upbound.io_instancegroups.yaml
+++ b/package/crds/compute.gcp.upbound.io_instancegroups.yaml
@@ -77,6 +77,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   namedPort:
                     description: The named port configuration. See the section below
                       for details on configuration. Structure is documented below.
@@ -203,6 +204,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   namedPort:
                     description: The named port configuration. See the section below
                       for details on configuration. Structure is documented below.
@@ -399,6 +401,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   namedPort:
                     description: The named port configuration. See the section below
                       for details on configuration. Structure is documented below.
diff --git a/package/crds/compute.gcp.upbound.io_instances.yaml b/package/crds/compute.gcp.upbound.io_instances.yaml
index 93f3129aa..731c76c95 100644
--- a/package/crds/compute.gcp.upbound.io_instances.yaml
+++ b/package/crds/compute.gcp.upbound.io_instances.yaml
@@ -287,6 +287,7 @@ spec:
                                   on whether a resource has a specific tag. This value
                                   is not returned by the API.
                                 type: object
+                                x-kubernetes-map-type: granular
                               size:
                                 description: The size of the image in gigabytes. If
                                   not specified, it will inherit the size of its base
@@ -386,6 +387,7 @@ spec:
                       type: string
                     description: A map of key/value label pairs to assign to the instance.
                     type: object
+                    x-kubernetes-map-type: granular
                   machineType:
                     description: The machine type to create.
                     type: string
@@ -398,6 +400,7 @@ spec:
                       to your instance. A list of default metadata values (e.g. ssh-keys)
                       can be found here
                     type: object
+                    x-kubernetes-map-type: granular
                   metadataStartupScript:
                     description: An alternative to using the startup-script metadata
                       key, except this one forces the instance to be recreated (thus
@@ -730,6 +733,7 @@ spec:
                             allow or deny policies based on whether a resource has
                             a specific tag. This value is not returned by the API.
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   project:
@@ -842,6 +846,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                         onHostMaintenance:
@@ -979,6 +984,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   shieldedInstanceConfig:
@@ -1022,6 +1028,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   zone:
                     description: The zone that the machine should be created in. If
                       it is not provided, the provider zone is used.
@@ -1128,6 +1135,7 @@ spec:
                                   on whether a resource has a specific tag. This value
                                   is not returned by the API.
                                 type: object
+                                x-kubernetes-map-type: granular
                               size:
                                 description: The size of the image in gigabytes. If
                                   not specified, it will inherit the size of its base
@@ -1227,6 +1235,7 @@ spec:
                       type: string
                     description: A map of key/value label pairs to assign to the instance.
                     type: object
+                    x-kubernetes-map-type: granular
                   machineType:
                     description: The machine type to create.
                     type: string
@@ -1239,6 +1248,7 @@ spec:
                       to your instance. A list of default metadata values (e.g. ssh-keys)
                       can be found here
                     type: object
+                    x-kubernetes-map-type: granular
                   metadataStartupScript:
                     description: An alternative to using the startup-script metadata
                       key, except this one forces the instance to be recreated (thus
@@ -1402,6 +1412,7 @@ spec:
                             allow or deny policies based on whether a resource has
                             a specific tag. This value is not returned by the API.
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   project:
@@ -1514,6 +1525,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                         onHostMaintenance:
@@ -1567,6 +1579,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   shieldedInstanceConfig:
@@ -1610,6 +1623,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                 type: object
               managementPolicies:
                 default:
@@ -1899,6 +1913,7 @@ spec:
                                   on whether a resource has a specific tag. This value
                                   is not returned by the API.
                                 type: object
+                                x-kubernetes-map-type: granular
                               size:
                                 description: The size of the image in gigabytes. If
                                   not specified, it will inherit the size of its base
@@ -2017,6 +2032,7 @@ spec:
                       type: string
                     description: A map of key/value label pairs to assign to the instance.
                     type: object
+                    x-kubernetes-map-type: granular
                   machineType:
                     description: The machine type to create.
                     type: string
@@ -2029,6 +2045,7 @@ spec:
                       to your instance. A list of default metadata values (e.g. ssh-keys)
                       can be found here
                     type: object
+                    x-kubernetes-map-type: granular
                   metadataFingerprint:
                     description: The unique fingerprint of the metadata.
                     type: string
@@ -2221,6 +2238,7 @@ spec:
                             allow or deny policies based on whether a resource has
                             a specific tag. This value is not returned by the API.
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   project:
@@ -2333,6 +2351,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                         onHostMaintenance:
@@ -2395,6 +2414,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   shieldedInstanceConfig:
@@ -2438,6 +2458,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   tagsFingerprint:
                     description: The unique fingerprint of the tags.
                     type: string
diff --git a/package/crds/compute.gcp.upbound.io_instancetemplates.yaml b/package/crds/compute.gcp.upbound.io_instancetemplates.yaml
index 9ec64bef5..3c71218fc 100644
--- a/package/crds/compute.gcp.upbound.io_instancetemplates.yaml
+++ b/package/crds/compute.gcp.upbound.io_instancetemplates.yaml
@@ -164,6 +164,7 @@ spec:
                           description: A set of ket/value label pairs to assign to
                             disk created from this template
                           type: object
+                          x-kubernetes-map-type: granular
                         mode:
                           description: The mode in which to attach this disk, either
                             READ_WRITE or READ_ONLY. If you are attaching or creating
@@ -341,6 +342,7 @@ spec:
                     description: A set of key/value label pairs to assign to instances
                       created from this template.
                     type: object
+                    x-kubernetes-map-type: granular
                   machineType:
                     description: The machine type to create.
                     type: string
@@ -750,6 +752,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                         onHostMaintenance:
@@ -864,6 +867,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   shieldedInstanceConfig:
@@ -897,6 +901,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                 type: object
               initProvider:
                 description: THIS IS A BETA FIELD. It will be honored unless the Management
@@ -1007,6 +1012,7 @@ spec:
                           description: A set of ket/value label pairs to assign to
                             disk created from this template
                           type: object
+                          x-kubernetes-map-type: granular
                         mode:
                           description: The mode in which to attach this disk, either
                             READ_WRITE or READ_ONLY. If you are attaching or creating
@@ -1099,6 +1105,7 @@ spec:
                     description: A set of key/value label pairs to assign to instances
                       created from this template.
                     type: object
+                    x-kubernetes-map-type: granular
                   machineType:
                     description: The machine type to create.
                     type: string
@@ -1344,6 +1351,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                         onHostMaintenance:
@@ -1375,6 +1383,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   shieldedInstanceConfig:
@@ -1408,6 +1417,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                 type: object
               managementPolicies:
                 default:
@@ -1680,6 +1690,7 @@ spec:
                           description: A set of ket/value label pairs to assign to
                             disk created from this template
                           type: object
+                          x-kubernetes-map-type: granular
                         mode:
                           description: The mode in which to attach this disk, either
                             READ_WRITE or READ_ONLY. If you are attaching or creating
@@ -1782,6 +1793,7 @@ spec:
                     description: A set of key/value label pairs to assign to instances
                       created from this template.
                     type: object
+                    x-kubernetes-map-type: granular
                   machineType:
                     description: The machine type to create.
                     type: string
@@ -2060,6 +2072,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                         onHostMaintenance:
@@ -2107,6 +2120,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   shieldedInstanceConfig:
@@ -2140,6 +2154,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   tagsFingerprint:
                     description: The unique fingerprint of the tags.
                     type: string
diff --git a/package/crds/compute.gcp.upbound.io_nodetemplates.yaml b/package/crds/compute.gcp.upbound.io_nodetemplates.yaml
index 172227fa6..78aa22d3d 100644
--- a/package/crds/compute.gcp.upbound.io_nodetemplates.yaml
+++ b/package/crds/compute.gcp.upbound.io_nodetemplates.yaml
@@ -80,6 +80,7 @@ spec:
                     description: Labels to use for node affinity, which will be used
                       in instance scheduling.
                     type: object
+                    x-kubernetes-map-type: granular
                   nodeType:
                     description: Node type to use for nodes group that are created
                       from this template. Only one of nodeTypeFlexibility and nodeType
@@ -159,6 +160,7 @@ spec:
                     description: Labels to use for node affinity, which will be used
                       in instance scheduling.
                     type: object
+                    x-kubernetes-map-type: granular
                   nodeType:
                     description: Node type to use for nodes group that are created
                       from this template. Only one of nodeTypeFlexibility and nodeType
@@ -391,6 +393,7 @@ spec:
                     description: Labels to use for node affinity, which will be used
                       in instance scheduling.
                     type: object
+                    x-kubernetes-map-type: granular
                   nodeType:
                     description: Node type to use for nodes group that are created
                       from this template. Only one of nodeTypeFlexibility and nodeType
diff --git a/package/crds/compute.gcp.upbound.io_perinstanceconfigs.yaml b/package/crds/compute.gcp.upbound.io_perinstanceconfigs.yaml
index b05204d33..51d57bbcb 100644
--- a/package/crds/compute.gcp.upbound.io_perinstanceconfigs.yaml
+++ b/package/crds/compute.gcp.upbound.io_perinstanceconfigs.yaml
@@ -282,6 +282,7 @@ spec:
                           description: Preserved metadata defined for this instance.
                             This is a list of key->value pairs.
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   project:
@@ -437,6 +438,7 @@ spec:
                           description: Preserved metadata defined for this instance.
                             This is a list of key->value pairs.
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   project:
@@ -683,6 +685,7 @@ spec:
                           description: Preserved metadata defined for this instance.
                             This is a list of key->value pairs.
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   project:
diff --git a/package/crds/compute.gcp.upbound.io_projectmetadata.yaml b/package/crds/compute.gcp.upbound.io_projectmetadata.yaml
index 01982b0c2..55ed431aa 100644
--- a/package/crds/compute.gcp.upbound.io_projectmetadata.yaml
+++ b/package/crds/compute.gcp.upbound.io_projectmetadata.yaml
@@ -72,6 +72,7 @@ spec:
                       type: string
                     description: A series of key value pairs.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -94,6 +95,7 @@ spec:
                       type: string
                     description: A series of key value pairs.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -277,6 +279,7 @@ spec:
                       type: string
                     description: A series of key value pairs.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
diff --git a/package/crds/compute.gcp.upbound.io_regionbackendservices.yaml b/package/crds/compute.gcp.upbound.io_regionbackendservices.yaml
index d2e68f777..fff8e8427 100644
--- a/package/crds/compute.gcp.upbound.io_regionbackendservices.yaml
+++ b/package/crds/compute.gcp.upbound.io_regionbackendservices.yaml
@@ -296,6 +296,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               queryStringWhitelist:
                                 description: Names of query string parameters to include
                                   in cache keys. All other parameters will be excluded.
@@ -305,6 +306,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                         cacheMode:
@@ -523,6 +525,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   healthChecksRefs:
                     description: References to RegionHealthCheck to populate healthChecks.
                     items:
@@ -955,6 +958,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               queryStringWhitelist:
                                 description: Names of query string parameters to include
                                   in cache keys. All other parameters will be excluded.
@@ -964,6 +968,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                         cacheMode:
@@ -1673,6 +1678,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               queryStringWhitelist:
                                 description: Names of query string parameters to include
                                   in cache keys. All other parameters will be excluded.
@@ -1682,6 +1688,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                         cacheMode:
@@ -1907,6 +1914,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   iap:
                     description: Settings for enabling Cloud Identity Aware Proxy
                       Structure is documented below.
diff --git a/package/crds/compute.gcp.upbound.io_regiondisks.yaml b/package/crds/compute.gcp.upbound.io_regiondisks.yaml
index b930a75bd..d0d0ee03f 100644
--- a/package/crds/compute.gcp.upbound.io_regiondisks.yaml
+++ b/package/crds/compute.gcp.upbound.io_regiondisks.yaml
@@ -221,6 +221,7 @@ spec:
                     description: Labels to apply to this disk.  A list of key->value
                       pairs.
                     type: object
+                    x-kubernetes-map-type: granular
                   licenses:
                     description: Any applicable license URI.
                     items:
@@ -422,6 +423,7 @@ spec:
                     description: Labels to apply to this disk.  A list of key->value
                       pairs.
                     type: object
+                    x-kubernetes-map-type: granular
                   licenses:
                     description: Any applicable license URI.
                     items:
@@ -717,6 +719,7 @@ spec:
                     description: Labels to apply to this disk.  A list of key->value
                       pairs.
                     type: object
+                    x-kubernetes-map-type: granular
                   lastAttachTimestamp:
                     description: Last attach timestamp in RFC3339 text format.
                     type: string
diff --git a/package/crds/compute.gcp.upbound.io_regioninstancegroupmanagers.yaml b/package/crds/compute.gcp.upbound.io_regioninstancegroupmanagers.yaml
index 374f0b7ba..caa3372f8 100644
--- a/package/crds/compute.gcp.upbound.io_regioninstancegroupmanagers.yaml
+++ b/package/crds/compute.gcp.upbound.io_regioninstancegroupmanagers.yaml
@@ -184,6 +184,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   instanceLifecyclePolicy:
                     items:
                       properties:
@@ -263,6 +264,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   targetPoolsRefs:
                     description: References to TargetPool to populate targetPools.
                     items:
@@ -606,6 +608,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   instanceLifecyclePolicy:
                     items:
                       properties:
@@ -1037,6 +1040,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   fingerprint:
                     description: The fingerprint of the instance group manager.
                     type: string
@@ -1183,6 +1187,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   targetSize:
                     description: The target number of running instances for this managed
                       instance group. This value should always be explicitly set unless
diff --git a/package/crds/compute.gcp.upbound.io_regionperinstanceconfigs.yaml b/package/crds/compute.gcp.upbound.io_regionperinstanceconfigs.yaml
index 261f05f56..2bbc6e5ba 100644
--- a/package/crds/compute.gcp.upbound.io_regionperinstanceconfigs.yaml
+++ b/package/crds/compute.gcp.upbound.io_regionperinstanceconfigs.yaml
@@ -204,6 +204,7 @@ spec:
                           description: Preserved metadata defined for this instance.
                             This is a list of key->value pairs.
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   project:
@@ -438,6 +439,7 @@ spec:
                           description: Preserved metadata defined for this instance.
                             This is a list of key->value pairs.
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   project:
@@ -681,6 +683,7 @@ spec:
                           description: Preserved metadata defined for this instance.
                             This is a list of key->value pairs.
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   project:
diff --git a/package/crds/compute.gcp.upbound.io_regionurlmaps.yaml b/package/crds/compute.gcp.upbound.io_regionurlmaps.yaml
index f4d9f15a9..e21b82496 100644
--- a/package/crds/compute.gcp.upbound.io_regionurlmaps.yaml
+++ b/package/crds/compute.gcp.upbound.io_regionurlmaps.yaml
@@ -743,6 +743,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         pathMatcher:
                           description: The name of the PathMatcher to use to match
                             the path portion of the URL if the hostRule matches the
@@ -922,6 +923,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               routeAction:
                                 description: In response to a matching matchRule,
                                   the load balancer performs advanced routing actions
@@ -3016,6 +3018,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         pathMatcher:
                           description: The name of the PathMatcher to use to match
                             the path portion of the URL if the hostRule matches the
@@ -3112,6 +3115,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               routeAction:
                                 description: In response to a matching matchRule,
                                   the load balancer performs advanced routing actions
@@ -4940,6 +4944,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         pathMatcher:
                           description: The name of the PathMatcher to use to match
                             the path portion of the URL if the hostRule matches the
@@ -5047,6 +5052,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               routeAction:
                                 description: In response to a matching matchRule,
                                   the load balancer performs advanced routing actions
diff --git a/package/crds/compute.gcp.upbound.io_resourcepolicies.yaml b/package/crds/compute.gcp.upbound.io_resourcepolicies.yaml
index 7685ccc89..dfdde5866 100644
--- a/package/crds/compute.gcp.upbound.io_resourcepolicies.yaml
+++ b/package/crds/compute.gcp.upbound.io_resourcepolicies.yaml
@@ -269,12 +269,14 @@ spec:
                                   type: string
                                 description: A set of key-value pairs.
                                 type: object
+                                x-kubernetes-map-type: granular
                               storageLocations:
                                 description: Cloud Storage bucket location to store
                                   the auto snapshot (regional or multi-regional)
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                       type: object
@@ -492,12 +494,14 @@ spec:
                                   type: string
                                 description: A set of key-value pairs.
                                 type: object
+                                x-kubernetes-map-type: granular
                               storageLocations:
                                 description: Cloud Storage bucket location to store
                                   the auto snapshot (regional or multi-regional)
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                       type: object
@@ -875,12 +879,14 @@ spec:
                                   type: string
                                 description: A set of key-value pairs.
                                 type: object
+                                x-kubernetes-map-type: granular
                               storageLocations:
                                 description: Cloud Storage bucket location to store
                                   the auto snapshot (regional or multi-regional)
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                       type: object
diff --git a/package/crds/compute.gcp.upbound.io_routernats.yaml b/package/crds/compute.gcp.upbound.io_routernats.yaml
index df308ea9d..62b54feda 100644
--- a/package/crds/compute.gcp.upbound.io_routernats.yaml
+++ b/package/crds/compute.gcp.upbound.io_routernats.yaml
@@ -74,6 +74,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   enableDynamicPortAllocation:
                     description: Enable Dynamic Port Allocation. If minPortsPerVm
                       is set, minPortsPerVm must be set to a power of two greater
@@ -129,6 +130,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -231,6 +233,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               sourceNatDrainIps:
                                 description: A list of URLs of the IP resources to
                                   be drained. These IPs must be valid static external
@@ -240,6 +243,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                         description:
@@ -369,6 +373,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         sourceIpRangesToNat:
                           description: 'List of options for which source IPs in the
                             subnetwork should have NAT enabled. Supported values include:
@@ -376,6 +381,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   tcpEstablishedIdleTimeoutSec:
@@ -416,6 +422,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   enableDynamicPortAllocation:
                     description: Enable Dynamic Port Allocation. If minPortsPerVm
                       is set, minPortsPerVm must be set to a power of two greater
@@ -471,6 +478,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -493,6 +501,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               sourceNatDrainIps:
                                 description: A list of URLs of the IP resources to
                                   be drained. These IPs must be valid static external
@@ -502,6 +511,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                         description:
@@ -552,6 +562,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         sourceIpRangesToNat:
                           description: 'List of options for which source IPs in the
                             subnetwork should have NAT enabled. Supported values include:
@@ -559,6 +570,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   tcpEstablishedIdleTimeoutSec:
@@ -760,6 +772,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   enableDynamicPortAllocation:
                     description: Enable Dynamic Port Allocation. If minPortsPerVm
                       is set, minPortsPerVm must be set to a power of two greater
@@ -818,6 +831,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -847,6 +861,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               sourceNatDrainIps:
                                 description: A list of URLs of the IP resources to
                                   be drained. These IPs must be valid static external
@@ -856,6 +871,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                         description:
@@ -909,6 +925,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         sourceIpRangesToNat:
                           description: 'List of options for which source IPs in the
                             subnetwork should have NAT enabled. Supported values include:
@@ -916,6 +933,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   tcpEstablishedIdleTimeoutSec:
diff --git a/package/crds/compute.gcp.upbound.io_routes.yaml b/package/crds/compute.gcp.upbound.io_routes.yaml
index d6090384a..b1e33ed36 100644
--- a/package/crds/compute.gcp.upbound.io_routes.yaml
+++ b/package/crds/compute.gcp.upbound.io_routes.yaml
@@ -340,6 +340,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                 type: object
               initProvider:
                 description: THIS IS A BETA FIELD. It will be honored unless the Management
@@ -393,6 +394,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                 type: object
               managementPolicies:
                 default:
@@ -626,6 +628,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                 type: object
               conditions:
                 description: Conditions of the resource.
diff --git a/package/crds/compute.gcp.upbound.io_securitypolicies.yaml b/package/crds/compute.gcp.upbound.io_securitypolicies.yaml
index 24b81ca22..92f4b3587 100644
--- a/package/crds/compute.gcp.upbound.io_securitypolicies.yaml
+++ b/package/crds/compute.gcp.upbound.io_securitypolicies.yaml
@@ -112,6 +112,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                         jsonParsing:
@@ -204,6 +205,7 @@ spec:
                                       items:
                                         type: string
                                       type: array
+                                      x-kubernetes-list-type: set
                                   type: object
                                 type: array
                               expr:
@@ -405,6 +407,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                         jsonParsing:
@@ -497,6 +500,7 @@ spec:
                                       items:
                                         type: string
                                       type: array
+                                      x-kubernetes-list-type: set
                                   type: object
                                 type: array
                               expr:
@@ -851,6 +855,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                         jsonParsing:
@@ -949,6 +954,7 @@ spec:
                                       items:
                                         type: string
                                       type: array
+                                      x-kubernetes-list-type: set
                                   type: object
                                 type: array
                               expr:
diff --git a/package/crds/compute.gcp.upbound.io_snapshots.yaml b/package/crds/compute.gcp.upbound.io_snapshots.yaml
index db6ce881f..8e18c5e19 100644
--- a/package/crds/compute.gcp.upbound.io_snapshots.yaml
+++ b/package/crds/compute.gcp.upbound.io_snapshots.yaml
@@ -84,6 +84,7 @@ spec:
                       type: string
                     description: Labels to apply to this Snapshot.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -280,6 +281,7 @@ spec:
                       type: string
                     description: Labels to apply to this Snapshot.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -526,6 +528,7 @@ spec:
                       type: string
                     description: Labels to apply to this Snapshot.
                     type: object
+                    x-kubernetes-map-type: granular
                   licenses:
                     description: A list of public visible licenses that apply to this
                       snapshot. This can be because the original image had licenses
diff --git a/package/crds/compute.gcp.upbound.io_sslpolicies.yaml b/package/crds/compute.gcp.upbound.io_sslpolicies.yaml
index f7c7b1cb2..3b2bf67f6 100644
--- a/package/crds/compute.gcp.upbound.io_sslpolicies.yaml
+++ b/package/crds/compute.gcp.upbound.io_sslpolicies.yaml
@@ -79,6 +79,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   description:
                     description: An optional description of this resource.
                     type: string
@@ -127,6 +128,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   description:
                     description: An optional description of this resource.
                     type: string
@@ -331,6 +333,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   description:
                     description: An optional description of this resource.
                     type: string
@@ -339,6 +342,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   fingerprint:
                     description: Fingerprint of this resource. A hash of the contents
                       stored in this object. This field is used in optimistic locking.
diff --git a/package/crds/compute.gcp.upbound.io_subnetworks.yaml b/package/crds/compute.gcp.upbound.io_subnetworks.yaml
index 178dcca3f..4bfc8b2f7 100644
--- a/package/crds/compute.gcp.upbound.io_subnetworks.yaml
+++ b/package/crds/compute.gcp.upbound.io_subnetworks.yaml
@@ -133,6 +133,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   network:
@@ -366,6 +367,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   privateIpGoogleAccess:
@@ -695,6 +697,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   network:
diff --git a/package/crds/compute.gcp.upbound.io_targetpools.yaml b/package/crds/compute.gcp.upbound.io_targetpools.yaml
index 052aa2612..a0dcd2a3f 100644
--- a/package/crds/compute.gcp.upbound.io_targetpools.yaml
+++ b/package/crds/compute.gcp.upbound.io_targetpools.yaml
@@ -166,6 +166,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -210,6 +211,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -410,6 +412,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
diff --git a/package/crds/compute.gcp.upbound.io_urlmaps.yaml b/package/crds/compute.gcp.upbound.io_urlmaps.yaml
index 5dd3e1c28..e6af303b5 100644
--- a/package/crds/compute.gcp.upbound.io_urlmaps.yaml
+++ b/package/crds/compute.gcp.upbound.io_urlmaps.yaml
@@ -621,6 +621,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         pathMatcher:
                           description: The name of the PathMatcher to use to match
                             the path portion of the URL if the hostRule matches the
@@ -1228,6 +1229,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               routeAction:
                                 description: In response to a matching matchRule,
                                   the load balancer performs advanced routing actions
@@ -3409,6 +3411,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         pathMatcher:
                           description: The name of the PathMatcher to use to match
                             the path portion of the URL if the hostRule matches the
@@ -3934,6 +3937,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               routeAction:
                                 description: In response to a matching matchRule,
                                   the load balancer performs advanced routing actions
@@ -5834,6 +5838,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         pathMatcher:
                           description: The name of the PathMatcher to use to match
                             the path portion of the URL if the hostRule matches the
@@ -6369,6 +6374,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               routeAction:
                                 description: In response to a matching matchRule,
                                   the load balancer performs advanced routing actions
diff --git a/package/crds/compute.gcp.upbound.io_vpntunnels.yaml b/package/crds/compute.gcp.upbound.io_vpntunnels.yaml
index ed6b5fa15..5475b662e 100644
--- a/package/crds/compute.gcp.upbound.io_vpntunnels.yaml
+++ b/package/crds/compute.gcp.upbound.io_vpntunnels.yaml
@@ -82,6 +82,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   peerExternalGateway:
                     description: URL of the peer side external VPN gateway to which
                       this VPN tunnel is connected.
@@ -190,6 +191,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   router:
                     description: URL of router resource to be used for dynamic routing.
                     type: string
@@ -478,6 +480,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   peerExternalGatewayInterface:
                     description: The interface ID of the external VPN gateway to which
                       this VPN tunnel is connected.
@@ -505,6 +508,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   vpnGatewayInterface:
                     description: The interface ID of the VPN gateway with which this
                       VPN tunnel is associated.
@@ -704,6 +708,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   peerExternalGateway:
                     description: URL of the peer side external VPN gateway to which
                       this VPN tunnel is connected.
@@ -739,6 +744,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   router:
                     description: URL of router resource to be used for dynamic routing.
                     type: string
diff --git a/package/crds/container.gcp.upbound.io_clusters.yaml b/package/crds/container.gcp.upbound.io_clusters.yaml
index e9fa8d2bf..fc08c2e7f 100644
--- a/package/crds/container.gcp.upbound.io_clusters.yaml
+++ b/package/crds/container.gcp.upbound.io_clusters.yaml
@@ -561,6 +561,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   enableKubernetesAlpha:
@@ -1127,6 +1128,7 @@ spec:
                             prefixes are reserved by Kubernetes Core components and
                             cannot be specified.
                           type: object
+                          x-kubernetes-map-type: granular
                         linuxNodeConfig:
                           description: Linux node configuration, currently supported
                             attributes can be found here. Note that validations happen
@@ -1142,6 +1144,7 @@ spec:
                                   Specified as a map from the key, such as net.core.wmem_max,
                                   to a string value.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         localNvmeSsdBlockConfig:
@@ -1176,6 +1179,7 @@ spec:
                             in the cluster. From GKE 1. To avoid this, set the value
                             in your config.
                           type: object
+                          x-kubernetes-map-type: granular
                         minCpuPlatform:
                           description: Minimum CPU platform to be used by this instance.
                             The instance may be scheduled on the specified or newer
@@ -1199,6 +1203,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         preemptible:
                           description: A boolean that represents whether or not the
                             underlying node VMs are preemptible. See the official
@@ -1222,6 +1227,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                         resourceLabels:
@@ -1231,6 +1237,7 @@ spec:
                             to each node. Refer here for how these labels are applied
                             to clusters, node pools and nodes.
                           type: object
+                          x-kubernetes-map-type: granular
                         serviceAccount:
                           description: The service account to be used by the Node
                             VMs. If not specified, the "default" service account is
@@ -1411,6 +1418,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   nodePoolDefaults:
                     description: Default NodePool settings for the entire cluster.
                       These settings are overridden if specified on the specific NodePool
@@ -1562,6 +1570,7 @@ spec:
                     description: The GCE resource labels (a map of key/value pairs)
                       to be applied to the cluster.
                     type: object
+                    x-kubernetes-map-type: granular
                   resourceUsageExportConfig:
                     description: Configuration for the ResourceUsageExportConfig feature.
                       Structure is documented below.
@@ -2230,6 +2239,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   enableKubernetesAlpha:
@@ -2709,6 +2719,7 @@ spec:
                             prefixes are reserved by Kubernetes Core components and
                             cannot be specified.
                           type: object
+                          x-kubernetes-map-type: granular
                         linuxNodeConfig:
                           description: Linux node configuration, currently supported
                             attributes can be found here. Note that validations happen
@@ -2724,6 +2735,7 @@ spec:
                                   Specified as a map from the key, such as net.core.wmem_max,
                                   to a string value.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         localNvmeSsdBlockConfig:
@@ -2758,6 +2770,7 @@ spec:
                             in the cluster. From GKE 1. To avoid this, set the value
                             in your config.
                           type: object
+                          x-kubernetes-map-type: granular
                         minCpuPlatform:
                           description: Minimum CPU platform to be used by this instance.
                             The instance may be scheduled on the specified or newer
@@ -2781,6 +2794,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         preemptible:
                           description: A boolean that represents whether or not the
                             underlying node VMs are preemptible. See the official
@@ -2804,6 +2818,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                         resourceLabels:
@@ -2813,6 +2828,7 @@ spec:
                             to each node. Refer here for how these labels are applied
                             to clusters, node pools and nodes.
                           type: object
+                          x-kubernetes-map-type: granular
                         shieldedInstanceConfig:
                           description: Shielded Instance options. Structure is documented
                             below.
@@ -2910,6 +2926,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   nodePoolDefaults:
                     description: Default NodePool settings for the entire cluster.
                       These settings are overridden if specified on the specific NodePool
@@ -3061,6 +3078,7 @@ spec:
                     description: The GCE resource labels (a map of key/value pairs)
                       to be applied to the cluster.
                     type: object
+                    x-kubernetes-map-type: granular
                   resourceUsageExportConfig:
                     description: Configuration for the ResourceUsageExportConfig feature.
                       Structure is documented below.
@@ -3813,6 +3831,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   enableKubernetesAlpha:
@@ -4333,6 +4352,7 @@ spec:
                             prefixes are reserved by Kubernetes Core components and
                             cannot be specified.
                           type: object
+                          x-kubernetes-map-type: granular
                         linuxNodeConfig:
                           description: Linux node configuration, currently supported
                             attributes can be found here. Note that validations happen
@@ -4348,6 +4368,7 @@ spec:
                                   Specified as a map from the key, such as net.core.wmem_max,
                                   to a string value.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         localNvmeSsdBlockConfig:
@@ -4382,6 +4403,7 @@ spec:
                             in the cluster. From GKE 1. To avoid this, set the value
                             in your config.
                           type: object
+                          x-kubernetes-map-type: granular
                         minCpuPlatform:
                           description: Minimum CPU platform to be used by this instance.
                             The instance may be scheduled on the specified or newer
@@ -4405,6 +4427,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         preemptible:
                           description: A boolean that represents whether or not the
                             underlying node VMs are preemptible. See the official
@@ -4428,6 +4451,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                         resourceLabels:
@@ -4437,6 +4461,7 @@ spec:
                             to each node. Refer here for how these labels are applied
                             to clusters, node pools and nodes.
                           type: object
+                          x-kubernetes-map-type: granular
                         serviceAccount:
                           description: The service account to be used by the Node
                             VMs. If not specified, the "default" service account is
@@ -4539,6 +4564,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   nodePool:
                     description: 'List of node pools associated with this cluster.
                       See google_container_node_pool for schema. Warning: node pools
@@ -4819,6 +4845,7 @@ spec:
                                   k8s.io/ prefixes are reserved by Kubernetes Core
                                   components and cannot be specified.
                                 type: object
+                                x-kubernetes-map-type: granular
                               linuxNodeConfig:
                                 description: Linux node configuration, currently supported
                                   attributes can be found here. Note that validations
@@ -4835,6 +4862,7 @@ spec:
                                         key, such as net.core.wmem_max, to a string
                                         value.
                                       type: object
+                                      x-kubernetes-map-type: granular
                                   type: object
                                 type: array
                               localNvmeSsdBlockConfig:
@@ -4872,6 +4900,7 @@ spec:
                                   to instances in the cluster. From GKE 1. To avoid
                                   this, set the value in your config.
                                 type: object
+                                x-kubernetes-map-type: granular
                               minCpuPlatform:
                                 description: Minimum CPU platform to be used by this
                                   instance. The instance may be scheduled on the specified
@@ -4896,6 +4925,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               preemptible:
                                 description: A boolean that represents whether or
                                   not the underlying node VMs are preemptible. See
@@ -4920,6 +4950,7 @@ spec:
                                       items:
                                         type: string
                                       type: array
+                                      x-kubernetes-list-type: set
                                   type: object
                                 type: array
                               resourceLabels:
@@ -4928,6 +4959,7 @@ spec:
                                 description: The GCE resource labels (a map of key/value
                                   pairs) to be applied to the cluster.
                                 type: object
+                                x-kubernetes-map-type: granular
                               serviceAccount:
                                 description: The service account to be used by the
                                   Node VMs. If not specified, the "default" service
@@ -5033,6 +5065,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         placementPolicy:
                           items:
                             properties:
@@ -5280,6 +5313,7 @@ spec:
                     description: The GCE resource labels (a map of key/value pairs)
                       to be applied to the cluster.
                     type: object
+                    x-kubernetes-map-type: granular
                   resourceUsageExportConfig:
                     description: Configuration for the ResourceUsageExportConfig feature.
                       Structure is documented below.
diff --git a/package/crds/container.gcp.upbound.io_nodepools.yaml b/package/crds/container.gcp.upbound.io_nodepools.yaml
index 3ab9f6ef3..46e166796 100644
--- a/package/crds/container.gcp.upbound.io_nodepools.yaml
+++ b/package/crds/container.gcp.upbound.io_nodepools.yaml
@@ -350,6 +350,7 @@ spec:
                           additionalProperties:
                             type: string
                           type: object
+                          x-kubernetes-map-type: granular
                         linuxNodeConfig:
                           description: Parameters used in creating the node pool.
                             See google_container_cluster for schema.
@@ -359,6 +360,7 @@ spec:
                                 additionalProperties:
                                   type: string
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         localNvmeSsdBlockConfig:
@@ -378,6 +380,7 @@ spec:
                           additionalProperties:
                             type: string
                           type: object
+                          x-kubernetes-map-type: granular
                         minCpuPlatform:
                           type: string
                         nodeGroup:
@@ -386,6 +389,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         preemptible:
                           type: boolean
                         reservationAffinity:
@@ -399,12 +403,14 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                         resourceLabels:
                           additionalProperties:
                             type: string
                           type: object
+                          x-kubernetes-map-type: granular
                         serviceAccount:
                           type: string
                         serviceAccountRef:
@@ -552,6 +558,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   placementPolicy:
                     description: Specifies a custom placement policy for the nodes.
                     items:
@@ -849,6 +856,7 @@ spec:
                           additionalProperties:
                             type: string
                           type: object
+                          x-kubernetes-map-type: granular
                         linuxNodeConfig:
                           description: Parameters used in creating the node pool.
                             See google_container_cluster for schema.
@@ -858,6 +866,7 @@ spec:
                                 additionalProperties:
                                   type: string
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         localNvmeSsdBlockConfig:
@@ -877,6 +886,7 @@ spec:
                           additionalProperties:
                             type: string
                           type: object
+                          x-kubernetes-map-type: granular
                         minCpuPlatform:
                           type: string
                         nodeGroup:
@@ -885,6 +895,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         preemptible:
                           type: boolean
                         reservationAffinity:
@@ -898,12 +909,14 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                         resourceLabels:
                           additionalProperties:
                             type: string
                           type: object
+                          x-kubernetes-map-type: granular
                         shieldedInstanceConfig:
                           items:
                             properties:
@@ -971,6 +984,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   placementPolicy:
                     description: Specifies a custom placement policy for the nodes.
                     items:
@@ -1445,6 +1459,7 @@ spec:
                           additionalProperties:
                             type: string
                           type: object
+                          x-kubernetes-map-type: granular
                         linuxNodeConfig:
                           description: Parameters used in creating the node pool.
                             See google_container_cluster for schema.
@@ -1454,6 +1469,7 @@ spec:
                                 additionalProperties:
                                   type: string
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         localNvmeSsdBlockConfig:
@@ -1473,6 +1489,7 @@ spec:
                           additionalProperties:
                             type: string
                           type: object
+                          x-kubernetes-map-type: granular
                         minCpuPlatform:
                           type: string
                         nodeGroup:
@@ -1481,6 +1498,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         preemptible:
                           type: boolean
                         reservationAffinity:
@@ -1494,12 +1512,14 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                             type: object
                           type: array
                         resourceLabels:
                           additionalProperties:
                             type: string
                           type: object
+                          x-kubernetes-map-type: granular
                         serviceAccount:
                           type: string
                         shieldedInstanceConfig:
@@ -1569,6 +1589,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   operation:
                     type: string
                   placementPolicy:
diff --git a/package/crds/containeranalysis.gcp.upbound.io_notes.yaml b/package/crds/containeranalysis.gcp.upbound.io_notes.yaml
index 80a357794..aa5045811 100644
--- a/package/crds/containeranalysis.gcp.upbound.io_notes.yaml
+++ b/package/crds/containeranalysis.gcp.upbound.io_notes.yaml
@@ -117,6 +117,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   relatedUrl:
                     description: URLs associated with this note and related metadata.
                       Structure is documented below.
@@ -195,6 +196,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   relatedUrl:
                     description: URLs associated with this note and related metadata.
                       Structure is documented below.
@@ -440,6 +442,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   relatedUrl:
                     description: URLs associated with this note and related metadata.
                       Structure is documented below.
diff --git a/package/crds/containeraws.gcp.upbound.io_clusters.yaml b/package/crds/containeraws.gcp.upbound.io_clusters.yaml
index 792dfdd37..f9468db4c 100644
--- a/package/crds/containeraws.gcp.upbound.io_clusters.yaml
+++ b/package/crds/containeraws.gcp.upbound.io_clusters.yaml
@@ -78,6 +78,7 @@ spec:
                       or less, begin and end with alphanumerics, with dashes (-),
                       underscores (_), dots (.), and alphanumerics between.'
                     type: object
+                    x-kubernetes-map-type: granular
                   authorization:
                     description: Configuration related to the cluster RBAC settings.
                     items:
@@ -282,6 +283,7 @@ spec:
                             (.+-=_:@/). Keys can be up to 127 Unicode characters.
                             Values can be up to 255 Unicode characters.
                           type: object
+                          x-kubernetes-map-type: granular
                         version:
                           description: The Kubernetes version to run on control plane
                             replicas (e.g. 1.19.10-gke.1000). You can list all supported
@@ -369,6 +371,7 @@ spec:
                       or less, begin and end with alphanumerics, with dashes (-),
                       underscores (_), dots (.), and alphanumerics between.'
                     type: object
+                    x-kubernetes-map-type: granular
                   authorization:
                     description: Configuration related to the cluster RBAC settings.
                     items:
@@ -573,6 +576,7 @@ spec:
                             (.+-=_:@/). Keys can be up to 127 Unicode characters.
                             Values can be up to 255 Unicode characters.
                           type: object
+                          x-kubernetes-map-type: granular
                         version:
                           description: The Kubernetes version to run on control plane
                             replicas (e.g. 1.19.10-gke.1000). You can list all supported
@@ -829,6 +833,7 @@ spec:
                       or less, begin and end with alphanumerics, with dashes (-),
                       underscores (_), dots (.), and alphanumerics between.'
                     type: object
+                    x-kubernetes-map-type: granular
                   authorization:
                     description: Configuration related to the cluster RBAC settings.
                     items:
@@ -1033,6 +1038,7 @@ spec:
                             (.+-=_:@/). Keys can be up to 127 Unicode characters.
                             Values can be up to 255 Unicode characters.
                           type: object
+                          x-kubernetes-map-type: granular
                         version:
                           description: The Kubernetes version to run on control plane
                             replicas (e.g. 1.19.10-gke.1000). You can list all supported
diff --git a/package/crds/containeraws.gcp.upbound.io_nodepools.yaml b/package/crds/containeraws.gcp.upbound.io_nodepools.yaml
index 31bd95d0b..93fc4cffc 100644
--- a/package/crds/containeraws.gcp.upbound.io_nodepools.yaml
+++ b/package/crds/containeraws.gcp.upbound.io_nodepools.yaml
@@ -78,6 +78,7 @@ spec:
                       or less, begin and end with alphanumerics, with dashes (-),
                       underscores (_), dots (.), and alphanumerics between.'
                     type: object
+                    x-kubernetes-map-type: granular
                   autoscaling:
                     description: Autoscaler configuration for this node pool.
                     items:
@@ -223,6 +224,7 @@ spec:
                             value pairs. Example: { "name": "wrench", "mass": "1.3kg",
                             "count": "3" }.'
                           type: object
+                          x-kubernetes-map-type: granular
                         proxyConfig:
                           description: Proxy configuration for outbound HTTP(S) traffic.
                           items:
@@ -300,6 +302,7 @@ spec:
                             be up to 127 Unicode characters. Values can be up to 255
                             Unicode characters.
                           type: object
+                          x-kubernetes-map-type: granular
                         taints:
                           description: Optional. The initial taints assigned to nodes
                             of this node pool.
@@ -370,6 +373,7 @@ spec:
                       or less, begin and end with alphanumerics, with dashes (-),
                       underscores (_), dots (.), and alphanumerics between.'
                     type: object
+                    x-kubernetes-map-type: granular
                   autoscaling:
                     description: Autoscaler configuration for this node pool.
                     items:
@@ -439,6 +443,7 @@ spec:
                             value pairs. Example: { "name": "wrench", "mass": "1.3kg",
                             "count": "3" }.'
                           type: object
+                          x-kubernetes-map-type: granular
                         proxyConfig:
                           description: Proxy configuration for outbound HTTP(S) traffic.
                           items:
@@ -516,6 +521,7 @@ spec:
                             be up to 127 Unicode characters. Values can be up to 255
                             Unicode characters.
                           type: object
+                          x-kubernetes-map-type: granular
                         taints:
                           description: Optional. The initial taints assigned to nodes
                             of this node pool.
@@ -755,6 +761,7 @@ spec:
                       or less, begin and end with alphanumerics, with dashes (-),
                       underscores (_), dots (.), and alphanumerics between.'
                     type: object
+                    x-kubernetes-map-type: granular
                   autoscaling:
                     description: Autoscaler configuration for this node pool.
                     items:
@@ -827,6 +834,7 @@ spec:
                             value pairs. Example: { "name": "wrench", "mass": "1.3kg",
                             "count": "3" }.'
                           type: object
+                          x-kubernetes-map-type: granular
                         proxyConfig:
                           description: Proxy configuration for outbound HTTP(S) traffic.
                           items:
@@ -904,6 +912,7 @@ spec:
                             be up to 127 Unicode characters. Values can be up to 255
                             Unicode characters.
                           type: object
+                          x-kubernetes-map-type: granular
                         taints:
                           description: Optional. The initial taints assigned to nodes
                             of this node pool.
diff --git a/package/crds/containerazure.gcp.upbound.io_clusters.yaml b/package/crds/containerazure.gcp.upbound.io_clusters.yaml
index 2d77153e9..d1e9ac1c2 100644
--- a/package/crds/containerazure.gcp.upbound.io_clusters.yaml
+++ b/package/crds/containerazure.gcp.upbound.io_clusters.yaml
@@ -78,6 +78,7 @@ spec:
                       or less, begin and end with alphanumerics, with dashes (-),
                       underscores (_), dots (.), and alphanumerics between.'
                     type: object
+                    x-kubernetes-map-type: granular
                   authorization:
                     description: Configuration related to the cluster RBAC settings.
                     items:
@@ -229,6 +230,7 @@ spec:
                           description: Optional. A set of tags to apply to all underlying
                             control plane Azure resources.
                           type: object
+                          x-kubernetes-map-type: granular
                         version:
                           description: The Kubernetes version to run on control plane
                             replicas (e.g. 1.19.10-gke.1000). You can list all supported
@@ -322,6 +324,7 @@ spec:
                       or less, begin and end with alphanumerics, with dashes (-),
                       underscores (_), dots (.), and alphanumerics between.'
                     type: object
+                    x-kubernetes-map-type: granular
                   authorization:
                     description: Configuration related to the cluster RBAC settings.
                     items:
@@ -473,6 +476,7 @@ spec:
                           description: Optional. A set of tags to apply to all underlying
                             control plane Azure resources.
                           type: object
+                          x-kubernetes-map-type: granular
                         version:
                           description: The Kubernetes version to run on control plane
                             replicas (e.g. 1.19.10-gke.1000). You can list all supported
@@ -739,6 +743,7 @@ spec:
                       or less, begin and end with alphanumerics, with dashes (-),
                       underscores (_), dots (.), and alphanumerics between.'
                     type: object
+                    x-kubernetes-map-type: granular
                   authorization:
                     description: Configuration related to the cluster RBAC settings.
                     items:
@@ -890,6 +895,7 @@ spec:
                           description: Optional. A set of tags to apply to all underlying
                             control plane Azure resources.
                           type: object
+                          x-kubernetes-map-type: granular
                         version:
                           description: The Kubernetes version to run on control plane
                             replicas (e.g. 1.19.10-gke.1000). You can list all supported
diff --git a/package/crds/containerazure.gcp.upbound.io_nodepools.yaml b/package/crds/containerazure.gcp.upbound.io_nodepools.yaml
index 307ce0a20..498a672c1 100644
--- a/package/crds/containerazure.gcp.upbound.io_nodepools.yaml
+++ b/package/crds/containerazure.gcp.upbound.io_nodepools.yaml
@@ -78,6 +78,7 @@ spec:
                       or less, begin and end with alphanumerics, with dashes (-),
                       underscores (_), dots (.), and alphanumerics between.'
                     type: object
+                    x-kubernetes-map-type: granular
                   autoscaling:
                     description: Autoscaler configuration for this node pool.
                     items:
@@ -227,6 +228,7 @@ spec:
                             Keys can be up to 127 Unicode characters. Values can be
                             up to 255 Unicode characters.
                           type: object
+                          x-kubernetes-map-type: granular
                         vmSize:
                           description: 'Optional. The Azure VM size name. Example:
                             Standard_DS2_v2. See (/anthos/clusters/docs/azure/reference/supported-vms)
@@ -286,6 +288,7 @@ spec:
                       or less, begin and end with alphanumerics, with dashes (-),
                       underscores (_), dots (.), and alphanumerics between.'
                     type: object
+                    x-kubernetes-map-type: granular
                   autoscaling:
                     description: Autoscaler configuration for this node pool.
                     items:
@@ -359,6 +362,7 @@ spec:
                             Keys can be up to 127 Unicode characters. Values can be
                             up to 255 Unicode characters.
                           type: object
+                          x-kubernetes-map-type: granular
                         vmSize:
                           description: 'Optional. The Azure VM size name. Example:
                             Standard_DS2_v2. See (/anthos/clusters/docs/azure/reference/supported-vms)
@@ -587,6 +591,7 @@ spec:
                       or less, begin and end with alphanumerics, with dashes (-),
                       underscores (_), dots (.), and alphanumerics between.'
                     type: object
+                    x-kubernetes-map-type: granular
                   autoscaling:
                     description: Autoscaler configuration for this node pool.
                     items:
@@ -663,6 +668,7 @@ spec:
                             Keys can be up to 127 Unicode characters. Values can be
                             up to 255 Unicode characters.
                           type: object
+                          x-kubernetes-map-type: granular
                         vmSize:
                           description: 'Optional. The Azure VM size name. Example:
                             Standard_DS2_v2. See (/anthos/clusters/docs/azure/reference/supported-vms)
diff --git a/package/crds/dataflow.gcp.upbound.io_jobs.yaml b/package/crds/dataflow.gcp.upbound.io_jobs.yaml
index 4088eb1d9..73203c6e2 100644
--- a/package/crds/dataflow.gcp.upbound.io_jobs.yaml
+++ b/package/crds/dataflow.gcp.upbound.io_jobs.yaml
@@ -73,6 +73,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   enableStreamingEngine:
                     description: Enable/disable the use of Streaming Engine for the
                       job. Note that Streaming Engine is enabled by default for pipelines
@@ -177,6 +178,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   enableStreamingEngine:
                     description: Enable/disable the use of Streaming Engine for the
                       job. Note that Streaming Engine is enabled by default for pipelines
@@ -447,6 +449,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   enableStreamingEngine:
                     description: Enable/disable the use of Streaming Engine for the
                       job. Note that Streaming Engine is enabled by default for pipelines
diff --git a/package/crds/datafusion.gcp.upbound.io_instances.yaml b/package/crds/datafusion.gcp.upbound.io_instances.yaml
index cab205924..1a812c5cb 100644
--- a/package/crds/datafusion.gcp.upbound.io_instances.yaml
+++ b/package/crds/datafusion.gcp.upbound.io_instances.yaml
@@ -294,6 +294,7 @@ spec:
                     description: The resource labels for instance to use to annotate
                       any related underlying resources, such as Compute Engine VMs.
                     type: object
+                    x-kubernetes-map-type: granular
                   networkConfig:
                     description: Network configuration options. These are required
                       when a private Data Fusion instance is to be created. Structure
@@ -321,6 +322,7 @@ spec:
                     description: Map of additional options used to configure the behavior
                       of Data Fusion instance.
                     type: object
+                    x-kubernetes-map-type: granular
                   privateInstance:
                     description: Specifies whether the Data Fusion instance should
                       be private. If set to true, all Data Fusion nodes will have
@@ -420,6 +422,7 @@ spec:
                     description: The resource labels for instance to use to annotate
                       any related underlying resources, such as Compute Engine VMs.
                     type: object
+                    x-kubernetes-map-type: granular
                   networkConfig:
                     description: Network configuration options. These are required
                       when a private Data Fusion instance is to be created. Structure
@@ -447,6 +450,7 @@ spec:
                     description: Map of additional options used to configure the behavior
                       of Data Fusion instance.
                     type: object
+                    x-kubernetes-map-type: granular
                   privateInstance:
                     description: Specifies whether the Data Fusion instance should
                       be private. If set to true, all Data Fusion nodes will have
@@ -725,6 +729,7 @@ spec:
                     description: The resource labels for instance to use to annotate
                       any related underlying resources, such as Compute Engine VMs.
                     type: object
+                    x-kubernetes-map-type: granular
                   networkConfig:
                     description: Network configuration options. These are required
                       when a private Data Fusion instance is to be created. Structure
@@ -752,6 +757,7 @@ spec:
                     description: Map of additional options used to configure the behavior
                       of Data Fusion instance.
                     type: object
+                    x-kubernetes-map-type: granular
                   p4ServiceAccount:
                     description: P4 service account for the customer project.
                     type: string
diff --git a/package/crds/datalossprevention.gcp.upbound.io_jobtriggers.yaml b/package/crds/datalossprevention.gcp.upbound.io_jobtriggers.yaml
index b47fb6893..b9df3b132 100644
--- a/package/crds/datalossprevention.gcp.upbound.io_jobtriggers.yaml
+++ b/package/crds/datalossprevention.gcp.upbound.io_jobtriggers.yaml
@@ -1519,6 +1519,7 @@ spec:
                                         No more than 10 labels can be associated with
                                         a given finding. Examples:'
                                       type: object
+                                      x-kubernetes-map-type: granular
                                     requiredFindingLabelKeys:
                                       description: 'These are labels that each inspection
                                         request must include within their ''finding_labels''
@@ -2928,6 +2929,7 @@ spec:
                                         No more than 10 labels can be associated with
                                         a given finding. Examples:'
                                       type: object
+                                      x-kubernetes-map-type: granular
                                     requiredFindingLabelKeys:
                                       description: 'These are labels that each inspection
                                         request must include within their ''finding_labels''
@@ -4521,6 +4523,7 @@ spec:
                                         No more than 10 labels can be associated with
                                         a given finding. Examples:'
                                       type: object
+                                      x-kubernetes-map-type: granular
                                     requiredFindingLabelKeys:
                                       description: 'These are labels that each inspection
                                         request must include within their ''finding_labels''
diff --git a/package/crds/dataplex.gcp.upbound.io_assets.yaml b/package/crds/dataplex.gcp.upbound.io_assets.yaml
index 0e22490da..39ea7c6fe 100644
--- a/package/crds/dataplex.gcp.upbound.io_assets.yaml
+++ b/package/crds/dataplex.gcp.upbound.io_assets.yaml
@@ -235,6 +235,7 @@ spec:
                       type: string
                     description: Optional. User defined labels for the asset.
                     type: object
+                    x-kubernetes-map-type: granular
                   lake:
                     description: The lake for the resource
                     type: string
@@ -442,6 +443,7 @@ spec:
                       type: string
                     description: Optional. User defined labels for the asset.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The project for the resource
                     type: string
@@ -774,6 +776,7 @@ spec:
                       type: string
                     description: Optional. User defined labels for the asset.
                     type: object
+                    x-kubernetes-map-type: granular
                   lake:
                     description: The lake for the resource
                     type: string
diff --git a/package/crds/dataplex.gcp.upbound.io_lakes.yaml b/package/crds/dataplex.gcp.upbound.io_lakes.yaml
index f7ea9bbe4..daa15d0d5 100644
--- a/package/crds/dataplex.gcp.upbound.io_lakes.yaml
+++ b/package/crds/dataplex.gcp.upbound.io_lakes.yaml
@@ -77,6 +77,7 @@ spec:
                       type: string
                     description: Optional. User-defined labels for the lake.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The location for the resource
                     type: string
@@ -121,6 +122,7 @@ spec:
                       type: string
                     description: Optional. User-defined labels for the lake.
                     type: object
+                    x-kubernetes-map-type: granular
                   metastore:
                     description: Optional. Settings to manage lake and Dataproc Metastore
                       service instance association.
@@ -334,6 +336,7 @@ spec:
                       type: string
                     description: Optional. User-defined labels for the lake.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The location for the resource
                     type: string
diff --git a/package/crds/dataplex.gcp.upbound.io_zones.yaml b/package/crds/dataplex.gcp.upbound.io_zones.yaml
index 30028cf6f..8cc3bda44 100644
--- a/package/crds/dataplex.gcp.upbound.io_zones.yaml
+++ b/package/crds/dataplex.gcp.upbound.io_zones.yaml
@@ -158,6 +158,7 @@ spec:
                       type: string
                     description: Optional. User defined labels for the zone.
                     type: object
+                    x-kubernetes-map-type: granular
                   lake:
                     description: The lake for the resource
                     type: string
@@ -364,6 +365,7 @@ spec:
                       type: string
                     description: Optional. User defined labels for the zone.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The project for the resource
                     type: string
@@ -676,6 +678,7 @@ spec:
                       type: string
                     description: Optional. User defined labels for the zone.
                     type: object
+                    x-kubernetes-map-type: granular
                   lake:
                     description: The lake for the resource
                     type: string
diff --git a/package/crds/dataproc.gcp.upbound.io_clusters.yaml b/package/crds/dataproc.gcp.upbound.io_clusters.yaml
index b35b78b1d..03b8b029e 100644
--- a/package/crds/dataproc.gcp.upbound.io_clusters.yaml
+++ b/package/crds/dataproc.gcp.upbound.io_clusters.yaml
@@ -102,6 +102,7 @@ spec:
                                       items:
                                         type: string
                                       type: array
+                                      x-kubernetes-list-type: set
                                     metricSource:
                                       description: A source for the collection of
                                         Dataproc OSS metrics (see available OSS metrics).
@@ -156,6 +157,7 @@ spec:
                                   entries to add to all instances (see Project and
                                   instance metadata).
                                 type: object
+                                x-kubernetes-map-type: granular
                               network:
                                 description: The name or self_link of the Google Compute
                                   Engine network to the cluster will be part of. Conflicts
@@ -192,6 +194,7 @@ spec:
                                       items:
                                         type: string
                                       type: array
+                                      x-kubernetes-list-type: set
                                   type: object
                                 type: array
                               serviceAccount:
@@ -246,6 +249,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               serviceAccountSelector:
                                 description: Selector for a ServiceAccount in cloudplatform
                                   to populate serviceAccount.
@@ -320,6 +324,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               zone:
                                 description: 'The GCP zone where your data is stored
                                   and used (i.e. where the master and the worker nodes
@@ -610,6 +615,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               overrideProperties:
                                 additionalProperties:
                                   type: string
@@ -619,6 +625,7 @@ spec:
                                   a cluster. For a list of valid properties please
                                   see Cluster properties
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         stagingBucket:
@@ -735,6 +742,7 @@ spec:
                       to instances in the cluster. GCP generates some itself including
                       goog-dataproc-cluster-name which is the name of the cluster.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: The name of the cluster, unique within the project
                       and zone.
@@ -896,6 +904,7 @@ spec:
                                                   items:
                                                     type: string
                                                   type: array
+                                                  x-kubernetes-list-type: set
                                               type: object
                                             type: array
                                           roles:
@@ -905,6 +914,7 @@ spec:
                                             items:
                                               type: string
                                             type: array
+                                            x-kubernetes-list-type: set
                                         type: object
                                       type: array
                                   type: object
@@ -931,6 +941,7 @@ spec:
                                         The value is the version of the software to
                                         be installed. At least one entry must be specified.
                                       type: object
+                                      x-kubernetes-map-type: granular
                                     properties:
                                       additionalProperties:
                                         type: string
@@ -938,6 +949,7 @@ spec:
                                         config files. Property keys are specified
                                         in prefix:property format, for example spark:spark.kubernetes.container.image.
                                       type: object
+                                      x-kubernetes-map-type: granular
                                   type: object
                                 type: array
                             type: object
@@ -1002,6 +1014,7 @@ spec:
                                       items:
                                         type: string
                                       type: array
+                                      x-kubernetes-list-type: set
                                     metricSource:
                                       description: A source for the collection of
                                         Dataproc OSS metrics (see available OSS metrics).
@@ -1056,6 +1069,7 @@ spec:
                                   entries to add to all instances (see Project and
                                   instance metadata).
                                 type: object
+                                x-kubernetes-map-type: granular
                               network:
                                 description: The name or self_link of the Google Compute
                                   Engine network to the cluster will be part of. Conflicts
@@ -1092,6 +1106,7 @@ spec:
                                       items:
                                         type: string
                                       type: array
+                                      x-kubernetes-list-type: set
                                   type: object
                                 type: array
                               serviceAccountScopes:
@@ -1104,6 +1119,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               shieldedInstanceConfig:
                                 description: Shielded Instance Config for clusters
                                   using Compute Engine Shielded VMs.
@@ -1135,6 +1151,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               zone:
                                 description: 'The GCP zone where your data is stored
                                   and used (i.e. where the master and the worker nodes
@@ -1425,6 +1442,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               overrideProperties:
                                 additionalProperties:
                                   type: string
@@ -1434,6 +1452,7 @@ spec:
                                   a cluster. For a list of valid properties please
                                   see Cluster properties
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         stagingBucket:
@@ -1550,6 +1569,7 @@ spec:
                       to instances in the cluster. GCP generates some itself including
                       goog-dataproc-cluster-name which is the name of the cluster.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: The name of the cluster, unique within the project
                       and zone.
@@ -1711,6 +1731,7 @@ spec:
                                                   items:
                                                     type: string
                                                   type: array
+                                                  x-kubernetes-list-type: set
                                               type: object
                                             type: array
                                           roles:
@@ -1720,6 +1741,7 @@ spec:
                                             items:
                                               type: string
                                             type: array
+                                            x-kubernetes-list-type: set
                                         type: object
                                       type: array
                                   type: object
@@ -1746,6 +1768,7 @@ spec:
                                         The value is the version of the software to
                                         be installed. At least one entry must be specified.
                                       type: object
+                                      x-kubernetes-map-type: granular
                                     properties:
                                       additionalProperties:
                                         type: string
@@ -1753,6 +1776,7 @@ spec:
                                         config files. Property keys are specified
                                         in prefix:property format, for example spark:spark.kubernetes.container.image.
                                       type: object
+                                      x-kubernetes-map-type: granular
                                   type: object
                                 type: array
                             type: object
@@ -1981,6 +2005,7 @@ spec:
                                       items:
                                         type: string
                                       type: array
+                                      x-kubernetes-list-type: set
                                     metricSource:
                                       description: A source for the collection of
                                         Dataproc OSS metrics (see available OSS metrics).
@@ -2017,6 +2042,7 @@ spec:
                                   Will only be populated if enable_http_port_access
                                   is true.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         gceClusterConfig:
@@ -2042,6 +2068,7 @@ spec:
                                   entries to add to all instances (see Project and
                                   instance metadata).
                                 type: object
+                                x-kubernetes-map-type: granular
                               network:
                                 description: The name or self_link of the Google Compute
                                   Engine network to the cluster will be part of. Conflicts
@@ -2078,6 +2105,7 @@ spec:
                                       items:
                                         type: string
                                       type: array
+                                      x-kubernetes-list-type: set
                                   type: object
                                 type: array
                               serviceAccount:
@@ -2095,6 +2123,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               shieldedInstanceConfig:
                                 description: Shielded Instance Config for clusters
                                   using Compute Engine Shielded VMs.
@@ -2126,6 +2155,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               zone:
                                 description: 'The GCP zone where your data is stored
                                   and used (i.e. where the master and the worker nodes
@@ -2433,6 +2463,7 @@ spec:
                                 items:
                                   type: string
                                 type: array
+                                x-kubernetes-list-type: set
                               overrideProperties:
                                 additionalProperties:
                                   type: string
@@ -2442,6 +2473,7 @@ spec:
                                   a cluster. For a list of valid properties please
                                   see Cluster properties
                                 type: object
+                                x-kubernetes-map-type: granular
                               properties:
                                 additionalProperties:
                                   type: string
@@ -2573,6 +2605,7 @@ spec:
                       to instances in the cluster. GCP generates some itself including
                       goog-dataproc-cluster-name which is the name of the cluster.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: The name of the cluster, unique within the project
                       and zone.
@@ -2734,6 +2767,7 @@ spec:
                                                   items:
                                                     type: string
                                                   type: array
+                                                  x-kubernetes-list-type: set
                                               type: object
                                             type: array
                                           roles:
@@ -2743,6 +2777,7 @@ spec:
                                             items:
                                               type: string
                                             type: array
+                                            x-kubernetes-list-type: set
                                         type: object
                                       type: array
                                   type: object
@@ -2769,6 +2804,7 @@ spec:
                                         The value is the version of the software to
                                         be installed. At least one entry must be specified.
                                       type: object
+                                      x-kubernetes-map-type: granular
                                     properties:
                                       additionalProperties:
                                         type: string
@@ -2776,6 +2812,7 @@ spec:
                                         config files. Property keys are specified
                                         in prefix:property format, for example spark:spark.kubernetes.container.image.
                                       type: object
+                                      x-kubernetes-map-type: granular
                                   type: object
                                 type: array
                             type: object
diff --git a/package/crds/dataproc.gcp.upbound.io_jobs.yaml b/package/crds/dataproc.gcp.upbound.io_jobs.yaml
index f23a939ea..5507a1465 100644
--- a/package/crds/dataproc.gcp.upbound.io_jobs.yaml
+++ b/package/crds/dataproc.gcp.upbound.io_jobs.yaml
@@ -113,6 +113,7 @@ spec:
                                   rootLogger. Examples: ''com.google = FATAL'', ''root
                                   = INFO'', ''org.apache = DEBUG'''
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         mainClass:
@@ -135,6 +136,7 @@ spec:
                             include properties set in /etc/hadoop/conf/*-site and
                             classes in user code..
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   hiveConfig:
@@ -162,6 +164,7 @@ spec:
                             include properties set in /etc/hadoop/conf/*-site.xml,
                             /etc/hive/conf/hive-site.xml, and classes in user code..
                           type: object
+                          x-kubernetes-map-type: granular
                         queryFileUri:
                           description: HCFS URI of file containing Hive script to
                             execute as the job. Conflicts with query_list
@@ -178,6 +181,7 @@ spec:
                           description: 'Mapping of query variable names to values
                             (equivalent to the Hive command: SET name="value";).'
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   labels:
@@ -186,6 +190,7 @@ spec:
                     description: The list of labels (key/value pairs) to add to the
                       job.
                     type: object
+                    x-kubernetes-map-type: granular
                   pigConfig:
                     items:
                       properties:
@@ -213,6 +218,7 @@ spec:
                                   rootLogger. Examples: ''com.google = FATAL'', ''root
                                   = INFO'', ''org.apache = DEBUG'''
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         properties:
@@ -224,6 +230,7 @@ spec:
                             include properties set in /etc/hadoop/conf/*-site.xml,
                             /etc/pig/conf/pig.properties, and classes in user code.
                           type: object
+                          x-kubernetes-map-type: granular
                         queryFileUri:
                           description: HCFS URI of file containing Hive script to
                             execute as the job. Conflicts with query_list
@@ -240,6 +247,7 @@ spec:
                           description: 'Mapping of query variable names to values
                             (equivalent to the Pig command: name=[value]).'
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   placement:
@@ -353,6 +361,7 @@ spec:
                                   rootLogger. Examples: ''com.google = FATAL'', ''root
                                   = INFO'', ''org.apache = DEBUG'''
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         outputFormat:
@@ -366,6 +375,7 @@ spec:
                             to set Presto session properties Equivalent to using the
                             --session flag in the Presto CLI.
                           type: object
+                          x-kubernetes-map-type: granular
                         queryFileUri:
                           description: The HCFS URI of the script that contains SQL
                             queries. Conflicts with query_list
@@ -421,6 +431,7 @@ spec:
                                   rootLogger. Examples: ''com.google = FATAL'', ''root
                                   = INFO'', ''org.apache = DEBUG'''
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         mainPythonFileUri:
@@ -436,6 +447,7 @@ spec:
                             include properties set in /etc/spark/conf/spark-defaults.conf
                             and classes in user code.
                           type: object
+                          x-kubernetes-map-type: granular
                         pythonFileUris:
                           description: 'HCFS file URIs of Python files to pass to
                             the PySpark framework. Supported file types: .py, .egg,
@@ -583,6 +595,7 @@ spec:
                                   rootLogger. Examples: ''com.google = FATAL'', ''root
                                   = INFO'', ''org.apache = DEBUG'''
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         mainClass:
@@ -603,6 +616,7 @@ spec:
                             include properties set in /etc/spark/conf/spark-defaults.conf
                             and classes in user code.
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   sparksqlConfig:
@@ -625,6 +639,7 @@ spec:
                                   rootLogger. Examples: ''com.google = FATAL'', ''root
                                   = INFO'', ''org.apache = DEBUG'''
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         properties:
@@ -634,6 +649,7 @@ spec:
                             to configure Spark SQL's SparkConf. Properties that conflict
                             with values set by the Cloud Dataproc API may be overwritten.
                           type: object
+                          x-kubernetes-map-type: granular
                         queryFileUri:
                           description: The HCFS URI of the script that contains SQL
                             queries. Conflicts with query_list
@@ -650,6 +666,7 @@ spec:
                           description: 'Mapping of query variable names to values
                             (equivalent to the Spark SQL command: SET name="value";).'
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                 type: object
@@ -711,6 +728,7 @@ spec:
                                   rootLogger. Examples: ''com.google = FATAL'', ''root
                                   = INFO'', ''org.apache = DEBUG'''
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         mainClass:
@@ -733,6 +751,7 @@ spec:
                             include properties set in /etc/hadoop/conf/*-site and
                             classes in user code..
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   hiveConfig:
@@ -760,6 +779,7 @@ spec:
                             include properties set in /etc/hadoop/conf/*-site.xml,
                             /etc/hive/conf/hive-site.xml, and classes in user code..
                           type: object
+                          x-kubernetes-map-type: granular
                         queryFileUri:
                           description: HCFS URI of file containing Hive script to
                             execute as the job. Conflicts with query_list
@@ -776,6 +796,7 @@ spec:
                           description: 'Mapping of query variable names to values
                             (equivalent to the Hive command: SET name="value";).'
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   labels:
@@ -784,6 +805,7 @@ spec:
                     description: The list of labels (key/value pairs) to add to the
                       job.
                     type: object
+                    x-kubernetes-map-type: granular
                   pigConfig:
                     items:
                       properties:
@@ -811,6 +833,7 @@ spec:
                                   rootLogger. Examples: ''com.google = FATAL'', ''root
                                   = INFO'', ''org.apache = DEBUG'''
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         properties:
@@ -822,6 +845,7 @@ spec:
                             include properties set in /etc/hadoop/conf/*-site.xml,
                             /etc/pig/conf/pig.properties, and classes in user code.
                           type: object
+                          x-kubernetes-map-type: granular
                         queryFileUri:
                           description: HCFS URI of file containing Hive script to
                             execute as the job. Conflicts with query_list
@@ -838,6 +862,7 @@ spec:
                           description: 'Mapping of query variable names to values
                             (equivalent to the Pig command: name=[value]).'
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   placement:
@@ -868,6 +893,7 @@ spec:
                                   rootLogger. Examples: ''com.google = FATAL'', ''root
                                   = INFO'', ''org.apache = DEBUG'''
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         outputFormat:
@@ -881,6 +907,7 @@ spec:
                             to set Presto session properties Equivalent to using the
                             --session flag in the Presto CLI.
                           type: object
+                          x-kubernetes-map-type: granular
                         queryFileUri:
                           description: The HCFS URI of the script that contains SQL
                             queries. Conflicts with query_list
@@ -936,6 +963,7 @@ spec:
                                   rootLogger. Examples: ''com.google = FATAL'', ''root
                                   = INFO'', ''org.apache = DEBUG'''
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         mainPythonFileUri:
@@ -951,6 +979,7 @@ spec:
                             include properties set in /etc/spark/conf/spark-defaults.conf
                             and classes in user code.
                           type: object
+                          x-kubernetes-map-type: granular
                         pythonFileUris:
                           description: 'HCFS file URIs of Python files to pass to
                             the PySpark framework. Supported file types: .py, .egg,
@@ -1020,6 +1049,7 @@ spec:
                                   rootLogger. Examples: ''com.google = FATAL'', ''root
                                   = INFO'', ''org.apache = DEBUG'''
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         mainClass:
@@ -1040,6 +1070,7 @@ spec:
                             include properties set in /etc/spark/conf/spark-defaults.conf
                             and classes in user code.
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   sparksqlConfig:
@@ -1062,6 +1093,7 @@ spec:
                                   rootLogger. Examples: ''com.google = FATAL'', ''root
                                   = INFO'', ''org.apache = DEBUG'''
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         properties:
@@ -1071,6 +1103,7 @@ spec:
                             to configure Spark SQL's SparkConf. Properties that conflict
                             with values set by the Cloud Dataproc API may be overwritten.
                           type: object
+                          x-kubernetes-map-type: granular
                         queryFileUri:
                           description: The HCFS URI of the script that contains SQL
                             queries. Conflicts with query_list
@@ -1087,6 +1120,7 @@ spec:
                           description: 'Mapping of query variable names to values
                             (equivalent to the Spark SQL command: SET name="value";).'
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                 type: object
@@ -1316,6 +1350,7 @@ spec:
                                   rootLogger. Examples: ''com.google = FATAL'', ''root
                                   = INFO'', ''org.apache = DEBUG'''
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         mainClass:
@@ -1338,6 +1373,7 @@ spec:
                             include properties set in /etc/hadoop/conf/*-site and
                             classes in user code..
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   hiveConfig:
@@ -1365,6 +1401,7 @@ spec:
                             include properties set in /etc/hadoop/conf/*-site.xml,
                             /etc/hive/conf/hive-site.xml, and classes in user code..
                           type: object
+                          x-kubernetes-map-type: granular
                         queryFileUri:
                           description: HCFS URI of file containing Hive script to
                             execute as the job. Conflicts with query_list
@@ -1381,6 +1418,7 @@ spec:
                           description: 'Mapping of query variable names to values
                             (equivalent to the Hive command: SET name="value";).'
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   id:
@@ -1391,6 +1429,7 @@ spec:
                     description: The list of labels (key/value pairs) to add to the
                       job.
                     type: object
+                    x-kubernetes-map-type: granular
                   pigConfig:
                     items:
                       properties:
@@ -1418,6 +1457,7 @@ spec:
                                   rootLogger. Examples: ''com.google = FATAL'', ''root
                                   = INFO'', ''org.apache = DEBUG'''
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         properties:
@@ -1429,6 +1469,7 @@ spec:
                             include properties set in /etc/hadoop/conf/*-site.xml,
                             /etc/pig/conf/pig.properties, and classes in user code.
                           type: object
+                          x-kubernetes-map-type: granular
                         queryFileUri:
                           description: HCFS URI of file containing Hive script to
                             execute as the job. Conflicts with query_list
@@ -1445,6 +1486,7 @@ spec:
                           description: 'Mapping of query variable names to values
                             (equivalent to the Pig command: name=[value]).'
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   placement:
@@ -1484,6 +1526,7 @@ spec:
                                   rootLogger. Examples: ''com.google = FATAL'', ''root
                                   = INFO'', ''org.apache = DEBUG'''
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         outputFormat:
@@ -1497,6 +1540,7 @@ spec:
                             to set Presto session properties Equivalent to using the
                             --session flag in the Presto CLI.
                           type: object
+                          x-kubernetes-map-type: granular
                         queryFileUri:
                           description: The HCFS URI of the script that contains SQL
                             queries. Conflicts with query_list
@@ -1552,6 +1596,7 @@ spec:
                                   rootLogger. Examples: ''com.google = FATAL'', ''root
                                   = INFO'', ''org.apache = DEBUG'''
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         mainPythonFileUri:
@@ -1567,6 +1612,7 @@ spec:
                             include properties set in /etc/spark/conf/spark-defaults.conf
                             and classes in user code.
                           type: object
+                          x-kubernetes-map-type: granular
                         pythonFileUris:
                           description: 'HCFS file URIs of Python files to pass to
                             the PySpark framework. Supported file types: .py, .egg,
@@ -1641,6 +1687,7 @@ spec:
                                   rootLogger. Examples: ''com.google = FATAL'', ''root
                                   = INFO'', ''org.apache = DEBUG'''
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         mainClass:
@@ -1661,6 +1708,7 @@ spec:
                             include properties set in /etc/spark/conf/spark-defaults.conf
                             and classes in user code.
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   sparksqlConfig:
@@ -1683,6 +1731,7 @@ spec:
                                   rootLogger. Examples: ''com.google = FATAL'', ''root
                                   = INFO'', ''org.apache = DEBUG'''
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         properties:
@@ -1692,6 +1741,7 @@ spec:
                             to configure Spark SQL's SparkConf. Properties that conflict
                             with values set by the Cloud Dataproc API may be overwritten.
                           type: object
+                          x-kubernetes-map-type: granular
                         queryFileUri:
                           description: The HCFS URI of the script that contains SQL
                             queries. Conflicts with query_list
@@ -1708,6 +1758,7 @@ spec:
                           description: 'Mapping of query variable names to values
                             (equivalent to the Spark SQL command: SET name="value";).'
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   status:
diff --git a/package/crds/dataproc.gcp.upbound.io_metastoreservices.yaml b/package/crds/dataproc.gcp.upbound.io_metastoreservices.yaml
index 881f01b8e..897243b8d 100644
--- a/package/crds/dataproc.gcp.upbound.io_metastoreservices.yaml
+++ b/package/crds/dataproc.gcp.upbound.io_metastoreservices.yaml
@@ -177,6 +177,7 @@ spec:
                             The mappings override system defaults (some keys cannot
                             be overridden)
                           type: object
+                          x-kubernetes-map-type: granular
                         kerberosConfig:
                           description: Information used to configure the Hive metastore
                             service as a service principal in a Kerberos realm. Structure
@@ -221,6 +222,7 @@ spec:
                       type: string
                     description: User-defined labels for the metastore service.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The location where the metastore service should reside.
                       The default value is global.
@@ -423,6 +425,7 @@ spec:
                             The mappings override system defaults (some keys cannot
                             be overridden)
                           type: object
+                          x-kubernetes-map-type: granular
                         kerberosConfig:
                           description: Information used to configure the Hive metastore
                             service as a service principal in a Kerberos realm. Structure
@@ -467,6 +470,7 @@ spec:
                       type: string
                     description: User-defined labels for the metastore service.
                     type: object
+                    x-kubernetes-map-type: granular
                   maintenanceWindow:
                     description: The one hour maintenance window of the metastore
                       service. This specifies when the service can be restarted for
@@ -741,6 +745,7 @@ spec:
                             The mappings override system defaults (some keys cannot
                             be overridden)
                           type: object
+                          x-kubernetes-map-type: granular
                         kerberosConfig:
                           description: Information used to configure the Hive metastore
                             service as a service principal in a Kerberos realm. Structure
@@ -788,6 +793,7 @@ spec:
                       type: string
                     description: User-defined labels for the metastore service.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The location where the metastore service should reside.
                       The default value is global.
diff --git a/package/crds/dataproc.gcp.upbound.io_workflowtemplates.yaml b/package/crds/dataproc.gcp.upbound.io_workflowtemplates.yaml
index a932b92fa..c0665bcd9 100644
--- a/package/crds/dataproc.gcp.upbound.io_workflowtemplates.yaml
+++ b/package/crds/dataproc.gcp.upbound.io_workflowtemplates.yaml
@@ -127,6 +127,7 @@ spec:
                                         = FATAL'', ''root = INFO'', ''org.apache =
                                         DEBUG'''
                                       type: object
+                                      x-kubernetes-map-type: granular
                                   type: object
                                 type: array
                               mainClass:
@@ -146,6 +147,7 @@ spec:
                                   that conflict with values set by the Dataproc API
                                   may be overwritten.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         hiveJob:
@@ -172,6 +174,7 @@ spec:
                                   that conflict with values set by the Dataproc API
                                   may be overwritten.
                                 type: object
+                                x-kubernetes-map-type: granular
                               queryFileUri:
                                 description: The HCFS URI of the script that contains
                                   SQL queries.
@@ -200,6 +203,7 @@ spec:
                                 description: 'Mapping of query variable names to values
                                   (equivalent to the Spark SQL command: SET name="value";).'
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         labels:
@@ -210,6 +214,7 @@ spec:
                             conform to the following regular expression: {0,63} No
                             more than 32 labels can be associated with a given job.'
                           type: object
+                          x-kubernetes-map-type: granular
                         pigJob:
                           description: Job is a Pig job.
                           items:
@@ -239,6 +244,7 @@ spec:
                                         = FATAL'', ''root = INFO'', ''org.apache =
                                         DEBUG'''
                                       type: object
+                                      x-kubernetes-map-type: granular
                                   type: object
                                 type: array
                               properties:
@@ -249,6 +255,7 @@ spec:
                                   that conflict with values set by the Dataproc API
                                   may be overwritten.
                                 type: object
+                                x-kubernetes-map-type: granular
                               queryFileUri:
                                 description: The HCFS URI of the script that contains
                                   SQL queries.
@@ -277,6 +284,7 @@ spec:
                                 description: 'Mapping of query variable names to values
                                   (equivalent to the Spark SQL command: SET name="value";).'
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         prerequisiteStepIds:
@@ -315,6 +323,7 @@ spec:
                                         = FATAL'', ''root = INFO'', ''org.apache =
                                         DEBUG'''
                                       type: object
+                                      x-kubernetes-map-type: granular
                                   type: object
                                 type: array
                               outputFormat:
@@ -330,6 +339,7 @@ spec:
                                   that conflict with values set by the Dataproc API
                                   may be overwritten.
                                 type: object
+                                x-kubernetes-map-type: granular
                               queryFileUri:
                                 description: The HCFS URI of the script that contains
                                   SQL queries.
@@ -399,6 +409,7 @@ spec:
                                         = FATAL'', ''root = INFO'', ''org.apache =
                                         DEBUG'''
                                       type: object
+                                      x-kubernetes-map-type: granular
                                   type: object
                                 type: array
                               mainPythonFileUri:
@@ -413,6 +424,7 @@ spec:
                                   that conflict with values set by the Dataproc API
                                   may be overwritten.
                                 type: object
+                                x-kubernetes-map-type: granular
                               pythonFileUris:
                                 description: 'HCFS file URIs of Python files to pass
                                   to the PySpark framework. Supported file types:
@@ -487,6 +499,7 @@ spec:
                                         = FATAL'', ''root = INFO'', ''org.apache =
                                         DEBUG'''
                                       type: object
+                                      x-kubernetes-map-type: granular
                                   type: object
                                 type: array
                               mainClass:
@@ -506,6 +519,7 @@ spec:
                                   that conflict with values set by the Dataproc API
                                   may be overwritten.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         sparkRJob:
@@ -547,6 +561,7 @@ spec:
                                         = FATAL'', ''root = INFO'', ''org.apache =
                                         DEBUG'''
                                       type: object
+                                      x-kubernetes-map-type: granular
                                   type: object
                                 type: array
                               mainRFileUri:
@@ -561,6 +576,7 @@ spec:
                                   that conflict with values set by the Dataproc API
                                   may be overwritten.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         sparkSqlJob:
@@ -586,6 +602,7 @@ spec:
                                         = FATAL'', ''root = INFO'', ''org.apache =
                                         DEBUG'''
                                       type: object
+                                      x-kubernetes-map-type: granular
                                   type: object
                                 type: array
                               properties:
@@ -596,6 +613,7 @@ spec:
                                   that conflict with values set by the Dataproc API
                                   may be overwritten.
                                 type: object
+                                x-kubernetes-map-type: granular
                               queryFileUri:
                                 description: The HCFS URI of the script that contains
                                   SQL queries.
@@ -624,6 +642,7 @@ spec:
                                 description: 'Mapping of query variable names to values
                                   (equivalent to the Spark SQL command: SET name="value";).'
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         stepId:
@@ -645,6 +664,7 @@ spec:
                       to the following PCRE regular expression: {0,63} No more than
                       32 labels can be associated with a given cluster.'
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The location for the resource
                     type: string
@@ -726,6 +746,7 @@ spec:
                                 description: Required. The cluster labels. Cluster
                                   must have all labels to match.
                                 type: object
+                                x-kubernetes-map-type: granular
                               zone:
                                 description: 'The zone where the Compute Engine cluster
                                   will be located. On a create request, it is required
@@ -819,6 +840,7 @@ spec:
                                               entries to add to all instances (see
                                               (https://cloud.google.com/compute/docs/storing-retrieving-metadata#project_and_instance_metadata)).
                                             type: object
+                                            x-kubernetes-map-type: granular
                                           network:
                                             description: The Compute Engine network
                                               to be used for machine communications.
@@ -921,6 +943,7 @@ spec:
                                             items:
                                               type: string
                                             type: array
+                                            x-kubernetes-list-type: set
                                           zone:
                                             description: 'The zone where the Compute
                                               Engine cluster will be located. On a
@@ -1316,6 +1339,7 @@ spec:
                                               with values set by the Dataproc API
                                               may be overwritten.
                                             type: object
+                                            x-kubernetes-map-type: granular
                                         type: object
                                       type: array
                                     stagingBucket:
@@ -1447,6 +1471,7 @@ spec:
                                   {0,63} No more than 32 labels can be associated
                                   with a given cluster.'
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                       type: object
@@ -1540,6 +1565,7 @@ spec:
                                         = FATAL'', ''root = INFO'', ''org.apache =
                                         DEBUG'''
                                       type: object
+                                      x-kubernetes-map-type: granular
                                   type: object
                                 type: array
                               mainClass:
@@ -1559,6 +1585,7 @@ spec:
                                   that conflict with values set by the Dataproc API
                                   may be overwritten.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         hiveJob:
@@ -1585,6 +1612,7 @@ spec:
                                   that conflict with values set by the Dataproc API
                                   may be overwritten.
                                 type: object
+                                x-kubernetes-map-type: granular
                               queryFileUri:
                                 description: The HCFS URI of the script that contains
                                   SQL queries.
@@ -1613,6 +1641,7 @@ spec:
                                 description: 'Mapping of query variable names to values
                                   (equivalent to the Spark SQL command: SET name="value";).'
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         labels:
@@ -1623,6 +1652,7 @@ spec:
                             conform to the following regular expression: {0,63} No
                             more than 32 labels can be associated with a given job.'
                           type: object
+                          x-kubernetes-map-type: granular
                         pigJob:
                           description: Job is a Pig job.
                           items:
@@ -1652,6 +1682,7 @@ spec:
                                         = FATAL'', ''root = INFO'', ''org.apache =
                                         DEBUG'''
                                       type: object
+                                      x-kubernetes-map-type: granular
                                   type: object
                                 type: array
                               properties:
@@ -1662,6 +1693,7 @@ spec:
                                   that conflict with values set by the Dataproc API
                                   may be overwritten.
                                 type: object
+                                x-kubernetes-map-type: granular
                               queryFileUri:
                                 description: The HCFS URI of the script that contains
                                   SQL queries.
@@ -1690,6 +1722,7 @@ spec:
                                 description: 'Mapping of query variable names to values
                                   (equivalent to the Spark SQL command: SET name="value";).'
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         prerequisiteStepIds:
@@ -1728,6 +1761,7 @@ spec:
                                         = FATAL'', ''root = INFO'', ''org.apache =
                                         DEBUG'''
                                       type: object
+                                      x-kubernetes-map-type: granular
                                   type: object
                                 type: array
                               outputFormat:
@@ -1743,6 +1777,7 @@ spec:
                                   that conflict with values set by the Dataproc API
                                   may be overwritten.
                                 type: object
+                                x-kubernetes-map-type: granular
                               queryFileUri:
                                 description: The HCFS URI of the script that contains
                                   SQL queries.
@@ -1812,6 +1847,7 @@ spec:
                                         = FATAL'', ''root = INFO'', ''org.apache =
                                         DEBUG'''
                                       type: object
+                                      x-kubernetes-map-type: granular
                                   type: object
                                 type: array
                               mainPythonFileUri:
@@ -1826,6 +1862,7 @@ spec:
                                   that conflict with values set by the Dataproc API
                                   may be overwritten.
                                 type: object
+                                x-kubernetes-map-type: granular
                               pythonFileUris:
                                 description: 'HCFS file URIs of Python files to pass
                                   to the PySpark framework. Supported file types:
@@ -1900,6 +1937,7 @@ spec:
                                         = FATAL'', ''root = INFO'', ''org.apache =
                                         DEBUG'''
                                       type: object
+                                      x-kubernetes-map-type: granular
                                   type: object
                                 type: array
                               mainClass:
@@ -1919,6 +1957,7 @@ spec:
                                   that conflict with values set by the Dataproc API
                                   may be overwritten.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         sparkRJob:
@@ -1960,6 +1999,7 @@ spec:
                                         = FATAL'', ''root = INFO'', ''org.apache =
                                         DEBUG'''
                                       type: object
+                                      x-kubernetes-map-type: granular
                                   type: object
                                 type: array
                               mainRFileUri:
@@ -1974,6 +2014,7 @@ spec:
                                   that conflict with values set by the Dataproc API
                                   may be overwritten.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         sparkSqlJob:
@@ -1999,6 +2040,7 @@ spec:
                                         = FATAL'', ''root = INFO'', ''org.apache =
                                         DEBUG'''
                                       type: object
+                                      x-kubernetes-map-type: granular
                                   type: object
                                 type: array
                               properties:
@@ -2009,6 +2051,7 @@ spec:
                                   that conflict with values set by the Dataproc API
                                   may be overwritten.
                                 type: object
+                                x-kubernetes-map-type: granular
                               queryFileUri:
                                 description: The HCFS URI of the script that contains
                                   SQL queries.
@@ -2037,6 +2080,7 @@ spec:
                                 description: 'Mapping of query variable names to values
                                   (equivalent to the Spark SQL command: SET name="value";).'
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         stepId:
@@ -2058,6 +2102,7 @@ spec:
                       to the following PCRE regular expression: {0,63} No more than
                       32 labels can be associated with a given cluster.'
                     type: object
+                    x-kubernetes-map-type: granular
                   parameters:
                     description: Template parameters whose values are substituted
                       into the template. Values for parameters must be provided when
@@ -2136,6 +2181,7 @@ spec:
                                 description: Required. The cluster labels. Cluster
                                   must have all labels to match.
                                 type: object
+                                x-kubernetes-map-type: granular
                               zone:
                                 description: 'The zone where the Compute Engine cluster
                                   will be located. On a create request, it is required
@@ -2229,6 +2275,7 @@ spec:
                                               entries to add to all instances (see
                                               (https://cloud.google.com/compute/docs/storing-retrieving-metadata#project_and_instance_metadata)).
                                             type: object
+                                            x-kubernetes-map-type: granular
                                           network:
                                             description: The Compute Engine network
                                               to be used for machine communications.
@@ -2331,6 +2378,7 @@ spec:
                                             items:
                                               type: string
                                             type: array
+                                            x-kubernetes-list-type: set
                                           zone:
                                             description: 'The zone where the Compute
                                               Engine cluster will be located. On a
@@ -2726,6 +2774,7 @@ spec:
                                               with values set by the Dataproc API
                                               may be overwritten.
                                             type: object
+                                            x-kubernetes-map-type: granular
                                         type: object
                                       type: array
                                     stagingBucket:
@@ -2857,6 +2906,7 @@ spec:
                                   {0,63} No more than 32 labels can be associated
                                   with a given cluster.'
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                       type: object
@@ -3116,6 +3166,7 @@ spec:
                                         = FATAL'', ''root = INFO'', ''org.apache =
                                         DEBUG'''
                                       type: object
+                                      x-kubernetes-map-type: granular
                                   type: object
                                 type: array
                               mainClass:
@@ -3135,6 +3186,7 @@ spec:
                                   that conflict with values set by the Dataproc API
                                   may be overwritten.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         hiveJob:
@@ -3161,6 +3213,7 @@ spec:
                                   that conflict with values set by the Dataproc API
                                   may be overwritten.
                                 type: object
+                                x-kubernetes-map-type: granular
                               queryFileUri:
                                 description: The HCFS URI of the script that contains
                                   SQL queries.
@@ -3189,6 +3242,7 @@ spec:
                                 description: 'Mapping of query variable names to values
                                   (equivalent to the Spark SQL command: SET name="value";).'
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         labels:
@@ -3199,6 +3253,7 @@ spec:
                             conform to the following regular expression: {0,63} No
                             more than 32 labels can be associated with a given job.'
                           type: object
+                          x-kubernetes-map-type: granular
                         pigJob:
                           description: Job is a Pig job.
                           items:
@@ -3228,6 +3283,7 @@ spec:
                                         = FATAL'', ''root = INFO'', ''org.apache =
                                         DEBUG'''
                                       type: object
+                                      x-kubernetes-map-type: granular
                                   type: object
                                 type: array
                               properties:
@@ -3238,6 +3294,7 @@ spec:
                                   that conflict with values set by the Dataproc API
                                   may be overwritten.
                                 type: object
+                                x-kubernetes-map-type: granular
                               queryFileUri:
                                 description: The HCFS URI of the script that contains
                                   SQL queries.
@@ -3266,6 +3323,7 @@ spec:
                                 description: 'Mapping of query variable names to values
                                   (equivalent to the Spark SQL command: SET name="value";).'
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         prerequisiteStepIds:
@@ -3304,6 +3362,7 @@ spec:
                                         = FATAL'', ''root = INFO'', ''org.apache =
                                         DEBUG'''
                                       type: object
+                                      x-kubernetes-map-type: granular
                                   type: object
                                 type: array
                               outputFormat:
@@ -3319,6 +3378,7 @@ spec:
                                   that conflict with values set by the Dataproc API
                                   may be overwritten.
                                 type: object
+                                x-kubernetes-map-type: granular
                               queryFileUri:
                                 description: The HCFS URI of the script that contains
                                   SQL queries.
@@ -3388,6 +3448,7 @@ spec:
                                         = FATAL'', ''root = INFO'', ''org.apache =
                                         DEBUG'''
                                       type: object
+                                      x-kubernetes-map-type: granular
                                   type: object
                                 type: array
                               mainPythonFileUri:
@@ -3402,6 +3463,7 @@ spec:
                                   that conflict with values set by the Dataproc API
                                   may be overwritten.
                                 type: object
+                                x-kubernetes-map-type: granular
                               pythonFileUris:
                                 description: 'HCFS file URIs of Python files to pass
                                   to the PySpark framework. Supported file types:
@@ -3476,6 +3538,7 @@ spec:
                                         = FATAL'', ''root = INFO'', ''org.apache =
                                         DEBUG'''
                                       type: object
+                                      x-kubernetes-map-type: granular
                                   type: object
                                 type: array
                               mainClass:
@@ -3495,6 +3558,7 @@ spec:
                                   that conflict with values set by the Dataproc API
                                   may be overwritten.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         sparkRJob:
@@ -3536,6 +3600,7 @@ spec:
                                         = FATAL'', ''root = INFO'', ''org.apache =
                                         DEBUG'''
                                       type: object
+                                      x-kubernetes-map-type: granular
                                   type: object
                                 type: array
                               mainRFileUri:
@@ -3550,6 +3615,7 @@ spec:
                                   that conflict with values set by the Dataproc API
                                   may be overwritten.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         sparkSqlJob:
@@ -3575,6 +3641,7 @@ spec:
                                         = FATAL'', ''root = INFO'', ''org.apache =
                                         DEBUG'''
                                       type: object
+                                      x-kubernetes-map-type: granular
                                   type: object
                                 type: array
                               properties:
@@ -3585,6 +3652,7 @@ spec:
                                   that conflict with values set by the Dataproc API
                                   may be overwritten.
                                 type: object
+                                x-kubernetes-map-type: granular
                               queryFileUri:
                                 description: The HCFS URI of the script that contains
                                   SQL queries.
@@ -3613,6 +3681,7 @@ spec:
                                 description: 'Mapping of query variable names to values
                                   (equivalent to the Spark SQL command: SET name="value";).'
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         stepId:
@@ -3634,6 +3703,7 @@ spec:
                       to the following PCRE regular expression: {0,63} No more than
                       32 labels can be associated with a given cluster.'
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The location for the resource
                     type: string
@@ -3715,6 +3785,7 @@ spec:
                                 description: Required. The cluster labels. Cluster
                                   must have all labels to match.
                                 type: object
+                                x-kubernetes-map-type: granular
                               zone:
                                 description: 'The zone where the Compute Engine cluster
                                   will be located. On a create request, it is required
@@ -3788,6 +3859,7 @@ spec:
                                               descriptions to URLs. Will only be populated
                                               if enable_http_port_access is true.
                                             type: object
+                                            x-kubernetes-map-type: granular
                                         type: object
                                       type: array
                                     gceClusterConfig:
@@ -3815,6 +3887,7 @@ spec:
                                               entries to add to all instances (see
                                               (https://cloud.google.com/compute/docs/storing-retrieving-metadata#project_and_instance_metadata)).
                                             type: object
+                                            x-kubernetes-map-type: granular
                                           network:
                                             description: The Compute Engine network
                                               to be used for machine communications.
@@ -3917,6 +3990,7 @@ spec:
                                             items:
                                               type: string
                                             type: array
+                                            x-kubernetes-list-type: set
                                           zone:
                                             description: 'The zone where the Compute
                                               Engine cluster will be located. On a
@@ -4407,6 +4481,7 @@ spec:
                                               with values set by the Dataproc API
                                               may be overwritten.
                                             type: object
+                                            x-kubernetes-map-type: granular
                                         type: object
                                       type: array
                                     stagingBucket:
@@ -4582,6 +4657,7 @@ spec:
                                   {0,63} No more than 32 labels can be associated
                                   with a given cluster.'
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                       type: object
diff --git a/package/crds/datastream.gcp.upbound.io_connectionprofiles.yaml b/package/crds/datastream.gcp.upbound.io_connectionprofiles.yaml
index 7f01ee5d2..155365326 100644
--- a/package/crds/datastream.gcp.upbound.io_connectionprofiles.yaml
+++ b/package/crds/datastream.gcp.upbound.io_connectionprofiles.yaml
@@ -146,6 +146,7 @@ spec:
                       type: string
                     description: Labels.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The name of the location this connection profile
                       is located in.
@@ -266,6 +267,7 @@ spec:
                             type: string
                           description: Connection string attributes
                           type: object
+                          x-kubernetes-map-type: granular
                         databaseService:
                           description: Database for the Oracle connection.
                           type: string
@@ -722,6 +724,7 @@ spec:
                       type: string
                     description: Labels.
                     type: object
+                    x-kubernetes-map-type: granular
                   mysqlProfile:
                     description: MySQL database profile. Structure is documented below.
                     items:
@@ -753,6 +756,7 @@ spec:
                             type: string
                           description: Connection string attributes
                           type: object
+                          x-kubernetes-map-type: granular
                         databaseService:
                           description: Database for the Oracle connection.
                           type: string
@@ -1002,6 +1006,7 @@ spec:
                       type: string
                     description: Labels.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The name of the location this connection profile
                       is located in.
@@ -1053,6 +1058,7 @@ spec:
                             type: string
                           description: Connection string attributes
                           type: object
+                          x-kubernetes-map-type: granular
                         databaseService:
                           description: Database for the Oracle connection.
                           type: string
diff --git a/package/crds/datastream.gcp.upbound.io_privateconnections.yaml b/package/crds/datastream.gcp.upbound.io_privateconnections.yaml
index bfce0f726..b334eae3a 100644
--- a/package/crds/datastream.gcp.upbound.io_privateconnections.yaml
+++ b/package/crds/datastream.gcp.upbound.io_privateconnections.yaml
@@ -76,6 +76,7 @@ spec:
                       type: string
                     description: Labels.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The name of the location this private connection
                       is located in.
@@ -200,6 +201,7 @@ spec:
                       type: string
                     description: Labels.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -403,6 +405,7 @@ spec:
                             type: string
                           description: A list of messages that carry the error details.
                           type: object
+                          x-kubernetes-map-type: granular
                         message:
                           description: A message containing more information about
                             the error that occurred.
@@ -417,6 +420,7 @@ spec:
                       type: string
                     description: Labels.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The name of the location this private connection
                       is located in.
diff --git a/package/crds/dialogflowcx.gcp.upbound.io_intents.yaml b/package/crds/dialogflowcx.gcp.upbound.io_intents.yaml
index 9ad1219ce..c040ef684 100644
--- a/package/crds/dialogflowcx.gcp.upbound.io_intents.yaml
+++ b/package/crds/dialogflowcx.gcp.upbound.io_intents.yaml
@@ -100,6 +100,7 @@ spec:
                       a list of "key": value pairs. Example: { "name": "wrench", "mass":
                       "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   languageCode:
                     description: 'The language of the following fields in intent:
                       Intent.training_phrases.parts.text If not specified, the agent''s
@@ -307,6 +308,7 @@ spec:
                       a list of "key": value pairs. Example: { "name": "wrench", "mass":
                       "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   languageCode:
                     description: 'The language of the following fields in intent:
                       Intent.training_phrases.parts.text If not specified, the agent''s
@@ -597,6 +599,7 @@ spec:
                       a list of "key": value pairs. Example: { "name": "wrench", "mass":
                       "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   languageCode:
                     description: 'The language of the following fields in intent:
                       Intent.training_phrases.parts.text If not specified, the agent''s
diff --git a/package/crds/dialogflowcx.gcp.upbound.io_webhooks.yaml b/package/crds/dialogflowcx.gcp.upbound.io_webhooks.yaml
index e6a2231df..53a6d5626 100644
--- a/package/crds/dialogflowcx.gcp.upbound.io_webhooks.yaml
+++ b/package/crds/dialogflowcx.gcp.upbound.io_webhooks.yaml
@@ -99,6 +99,7 @@ spec:
                           description: The HTTP request headers to send together with
                             webhook requests.
                           type: object
+                          x-kubernetes-map-type: granular
                         uri:
                           description: Whether to use speech adaptation for speech
                             recognition.
@@ -209,6 +210,7 @@ spec:
                                 description: The HTTP request headers to send together
                                   with webhook requests.
                                 type: object
+                                x-kubernetes-map-type: granular
                               uri:
                                 description: Whether to use speech adaptation for
                                   speech recognition.
@@ -268,6 +270,7 @@ spec:
                           description: The HTTP request headers to send together with
                             webhook requests.
                           type: object
+                          x-kubernetes-map-type: granular
                         uri:
                           description: Whether to use speech adaptation for speech
                             recognition.
@@ -300,6 +303,7 @@ spec:
                                 description: The HTTP request headers to send together
                                   with webhook requests.
                                 type: object
+                                x-kubernetes-map-type: granular
                               uri:
                                 description: Whether to use speech adaptation for
                                   speech recognition.
@@ -517,6 +521,7 @@ spec:
                           description: The HTTP request headers to send together with
                             webhook requests.
                           type: object
+                          x-kubernetes-map-type: granular
                         uri:
                           description: Whether to use speech adaptation for speech
                             recognition.
@@ -558,6 +563,7 @@ spec:
                                 description: The HTTP request headers to send together
                                   with webhook requests.
                                 type: object
+                                x-kubernetes-map-type: granular
                               uri:
                                 description: Whether to use speech adaptation for
                                   speech recognition.
diff --git a/package/crds/dns.gcp.upbound.io_managedzones.yaml b/package/crds/dns.gcp.upbound.io_managedzones.yaml
index ea9c3c3c8..caac6fc38 100644
--- a/package/crds/dns.gcp.upbound.io_managedzones.yaml
+++ b/package/crds/dns.gcp.upbound.io_managedzones.yaml
@@ -175,6 +175,7 @@ spec:
                     description: A set of key/value label pairs to assign to this
                       ManagedZone.
                     type: object
+                    x-kubernetes-map-type: granular
                   peeringConfig:
                     description: The presence of this field indicates that DNS Peering
                       is enabled for this zone. The value of this field contains the
@@ -604,6 +605,7 @@ spec:
                     description: A set of key/value label pairs to assign to this
                       ManagedZone.
                     type: object
+                    x-kubernetes-map-type: granular
                   peeringConfig:
                     description: The presence of this field indicates that DNS Peering
                       is enabled for this zone. The value of this field contains the
@@ -938,6 +940,7 @@ spec:
                     description: A set of key/value label pairs to assign to this
                       ManagedZone.
                     type: object
+                    x-kubernetes-map-type: granular
                   managedZoneId:
                     description: Unique identifier for the resource; defined by the
                       server.
diff --git a/package/crds/eventarc.gcp.upbound.io_triggers.yaml b/package/crds/eventarc.gcp.upbound.io_triggers.yaml
index 5dd1ee59f..65ea6d7d4 100644
--- a/package/crds/eventarc.gcp.upbound.io_triggers.yaml
+++ b/package/crds/eventarc.gcp.upbound.io_triggers.yaml
@@ -233,6 +233,7 @@ spec:
                     description: Optional. User labels attached to the triggers that
                       can be used to group resources.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The location for the resource
                     type: string
@@ -394,6 +395,7 @@ spec:
                     description: Optional. User labels attached to the triggers that
                       can be used to group resources.
                     type: object
+                    x-kubernetes-map-type: granular
                   matchingCriteria:
                     description: Required. null The list of filters that applies to
                       event attributes. Only events that match all the provided filters
@@ -646,6 +648,7 @@ spec:
                     description: Output only. The reason(s) why a trigger is in FAILED
                       state.
                     type: object
+                    x-kubernetes-map-type: granular
                   createTime:
                     description: Output only. The creation time.
                     type: string
@@ -736,6 +739,7 @@ spec:
                     description: Optional. User labels attached to the triggers that
                       can be used to group resources.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The location for the resource
                     type: string
diff --git a/package/crds/filestore.gcp.upbound.io_backups.yaml b/package/crds/filestore.gcp.upbound.io_backups.yaml
index f672de667..06a53d887 100644
--- a/package/crds/filestore.gcp.upbound.io_backups.yaml
+++ b/package/crds/filestore.gcp.upbound.io_backups.yaml
@@ -76,6 +76,7 @@ spec:
                       type: string
                     description: Resource labels to represent user-provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The name of the location of the instance. This can
                       be a region for ENTERPRISE tier instances.
@@ -192,6 +193,7 @@ spec:
                       type: string
                     description: Resource labels to represent user-provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -398,6 +400,7 @@ spec:
                       type: string
                     description: Resource labels to represent user-provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The name of the location of the instance. This can
                       be a region for ENTERPRISE tier instances.
diff --git a/package/crds/filestore.gcp.upbound.io_instances.yaml b/package/crds/filestore.gcp.upbound.io_instances.yaml
index dc3fd7f6b..29ed80f2c 100644
--- a/package/crds/filestore.gcp.upbound.io_instances.yaml
+++ b/package/crds/filestore.gcp.upbound.io_instances.yaml
@@ -214,6 +214,7 @@ spec:
                       type: string
                     description: Resource labels to represent user-provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The name of the location of the instance. This can
                       be a region for ENTERPRISE tier instances.
@@ -343,6 +344,7 @@ spec:
                       type: string
                     description: Resource labels to represent user-provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   networks:
                     description: VPC networks to which the instance is connected.
                       For this version, only a single network is supported. Structure
@@ -652,6 +654,7 @@ spec:
                       type: string
                     description: Resource labels to represent user-provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The name of the location of the instance. This can
                       be a region for ENTERPRISE tier instances.
diff --git a/package/crds/filestore.gcp.upbound.io_snapshots.yaml b/package/crds/filestore.gcp.upbound.io_snapshots.yaml
index c762baec0..5d74232a2 100644
--- a/package/crds/filestore.gcp.upbound.io_snapshots.yaml
+++ b/package/crds/filestore.gcp.upbound.io_snapshots.yaml
@@ -154,6 +154,7 @@ spec:
                       type: string
                     description: Resource labels to represent user-provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The name of the location of the instance. This can
                       be a region for ENTERPRISE tier instances.
@@ -186,6 +187,7 @@ spec:
                       type: string
                     description: Resource labels to represent user-provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -379,6 +381,7 @@ spec:
                       type: string
                     description: Resource labels to represent user-provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The name of the location of the instance. This can
                       be a region for ENTERPRISE tier instances.
diff --git a/package/crds/gke.gcp.upbound.io_backupbackupplans.yaml b/package/crds/gke.gcp.upbound.io_backupbackupplans.yaml
index bc07fa376..6c94d44f0 100644
--- a/package/crds/gke.gcp.upbound.io_backupbackupplans.yaml
+++ b/package/crds/gke.gcp.upbound.io_backupbackupplans.yaml
@@ -323,6 +323,7 @@ spec:
                       the user. A list of key->value pairs. Example: { "name": "wrench",
                       "mass": "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The region of the Backup Plan.
                     type: string
@@ -474,6 +475,7 @@ spec:
                       the user. A list of key->value pairs. Example: { "name": "wrench",
                       "mass": "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -796,6 +798,7 @@ spec:
                       the user. A list of key->value pairs. Example: { "name": "wrench",
                       "mass": "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The region of the Backup Plan.
                     type: string
diff --git a/package/crds/gkehub.gcp.upbound.io_memberships.yaml b/package/crds/gkehub.gcp.upbound.io_memberships.yaml
index 3a25c86b1..358ec7923 100644
--- a/package/crds/gkehub.gcp.upbound.io_memberships.yaml
+++ b/package/crds/gkehub.gcp.upbound.io_memberships.yaml
@@ -189,6 +189,7 @@ spec:
                       type: string
                     description: Labels to apply to this membership.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -241,6 +242,7 @@ spec:
                       type: string
                     description: Labels to apply to this membership.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -456,6 +458,7 @@ spec:
                       type: string
                     description: Labels to apply to this membership.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: The unique identifier of the membership.
                     type: string
diff --git a/package/crds/healthcare.gcp.upbound.io_consentstores.yaml b/package/crds/healthcare.gcp.upbound.io_consentstores.yaml
index 60a39e33b..ada4bed1d 100644
--- a/package/crds/healthcare.gcp.upbound.io_consentstores.yaml
+++ b/package/crds/healthcare.gcp.upbound.io_consentstores.yaml
@@ -172,6 +172,7 @@ spec:
                       An object containing a list of "key": value pairs. Example:
                       { "name": "wrench", "mass": "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: 'The name of this ConsentStore, for example: "consent1"'
                     type: string
@@ -213,6 +214,7 @@ spec:
                       An object containing a list of "key": value pairs. Example:
                       { "name": "wrench", "mass": "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: 'The name of this ConsentStore, for example: "consent1"'
                     type: string
@@ -419,6 +421,7 @@ spec:
                       An object containing a list of "key": value pairs. Example:
                       { "name": "wrench", "mass": "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: 'The name of this ConsentStore, for example: "consent1"'
                     type: string
diff --git a/package/crds/iam.gcp.upbound.io_workloadidentitypoolproviders.yaml b/package/crds/iam.gcp.upbound.io_workloadidentitypoolproviders.yaml
index c74ec80df..b032cc4b6 100644
--- a/package/crds/iam.gcp.upbound.io_workloadidentitypoolproviders.yaml
+++ b/package/crds/iam.gcp.upbound.io_workloadidentitypoolproviders.yaml
@@ -84,6 +84,7 @@ spec:
                       the Google Cloud IAM attribute to map to. The following keys
                       are supported:'
                     type: object
+                    x-kubernetes-map-type: granular
                   aws:
                     description: An Amazon Web Services identity provider. Not compatible
                       with the property oidc. Structure is documented below.
@@ -252,6 +253,7 @@ spec:
                       the Google Cloud IAM attribute to map to. The following keys
                       are supported:'
                     type: object
+                    x-kubernetes-map-type: granular
                   aws:
                     description: An Amazon Web Services identity provider. Not compatible
                       with the property oidc. Structure is documented below.
@@ -493,6 +495,7 @@ spec:
                       the Google Cloud IAM attribute to map to. The following keys
                       are supported:'
                     type: object
+                    x-kubernetes-map-type: granular
                   aws:
                     description: An Amazon Web Services identity provider. Not compatible
                       with the property oidc. Structure is documented below.
diff --git a/package/crds/identityplatform.gcp.upbound.io_projectdefaultconfigs.yaml b/package/crds/identityplatform.gcp.upbound.io_projectdefaultconfigs.yaml
index fae4d5d84..bfee97729 100644
--- a/package/crds/identityplatform.gcp.upbound.io_projectdefaultconfigs.yaml
+++ b/package/crds/identityplatform.gcp.upbound.io_projectdefaultconfigs.yaml
@@ -125,6 +125,7 @@ spec:
                                 description: A map of <test phone number, fake code>
                                   that can be used for phone auth testing.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                       type: object
@@ -200,6 +201,7 @@ spec:
                                 description: A map of <test phone number, fake code>
                                   that can be used for phone auth testing.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                       type: object
@@ -465,6 +467,7 @@ spec:
                                 description: A map of <test phone number, fake code>
                                   that can be used for phone auth testing.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                       type: object
diff --git a/package/crds/kms.gcp.upbound.io_cryptokeys.yaml b/package/crds/kms.gcp.upbound.io_cryptokeys.yaml
index eb19a54d5..030eacddc 100644
--- a/package/crds/kms.gcp.upbound.io_cryptokeys.yaml
+++ b/package/crds/kms.gcp.upbound.io_cryptokeys.yaml
@@ -157,6 +157,7 @@ spec:
                     description: Labels with user-defined metadata to apply to this
                       resource.
                     type: object
+                    x-kubernetes-map-type: granular
                   purpose:
                     description: The immutable purpose of this CryptoKey. See the
                       purpose reference for possible inputs. Default value is "ENCRYPT_DECRYPT".
@@ -220,6 +221,7 @@ spec:
                     description: Labels with user-defined metadata to apply to this
                       resource.
                     type: object
+                    x-kubernetes-map-type: granular
                   purpose:
                     description: The immutable purpose of this CryptoKey. See the
                       purpose reference for possible inputs. Default value is "ENCRYPT_DECRYPT".
@@ -442,6 +444,7 @@ spec:
                     description: Labels with user-defined metadata to apply to this
                       resource.
                     type: object
+                    x-kubernetes-map-type: granular
                   purpose:
                     description: The immutable purpose of this CryptoKey. See the
                       purpose reference for possible inputs. Default value is "ENCRYPT_DECRYPT".
diff --git a/package/crds/logging.gcp.upbound.io_metrics.yaml b/package/crds/logging.gcp.upbound.io_metrics.yaml
index a0b058ae6..8988df73c 100644
--- a/package/crds/logging.gcp.upbound.io_metrics.yaml
+++ b/package/crds/logging.gcp.upbound.io_metrics.yaml
@@ -229,6 +229,7 @@ spec:
                       syntax of the extractor expression is the same as for the valueExtractor
                       field.
                     type: object
+                    x-kubernetes-map-type: granular
                   metricDescriptor:
                     description: The optional metric descriptor associated with the
                       logs-based metric. If unspecified, it uses a default metric
@@ -405,6 +406,7 @@ spec:
                       syntax of the extractor expression is the same as for the valueExtractor
                       field.
                     type: object
+                    x-kubernetes-map-type: granular
                   metricDescriptor:
                     description: The optional metric descriptor associated with the
                       logs-based metric. If unspecified, it uses a default metric
@@ -747,6 +749,7 @@ spec:
                       syntax of the extractor expression is the same as for the valueExtractor
                       field.
                     type: object
+                    x-kubernetes-map-type: granular
                   metricDescriptor:
                     description: The optional metric descriptor associated with the
                       logs-based metric. If unspecified, it uses a default metric
diff --git a/package/crds/memcache.gcp.upbound.io_instances.yaml b/package/crds/memcache.gcp.upbound.io_instances.yaml
index dfa45d626..f38a94994 100644
--- a/package/crds/memcache.gcp.upbound.io_instances.yaml
+++ b/package/crds/memcache.gcp.upbound.io_instances.yaml
@@ -154,6 +154,7 @@ spec:
                       type: string
                     description: Resource labels to represent user-provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   maintenancePolicy:
                     description: Maintenance policy for an instance. Structure is
                       documented below.
@@ -222,6 +223,7 @@ spec:
                           description: User-defined set of parameters to use in the
                             memcache process.
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   memcacheVersion:
@@ -266,6 +268,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                 type: object
               initProvider:
                 description: THIS IS A BETA FIELD. It will be honored unless the Management
@@ -287,6 +290,7 @@ spec:
                       type: string
                     description: Resource labels to represent user-provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   maintenancePolicy:
                     description: Maintenance policy for an instance. Structure is
                       documented below.
@@ -355,6 +359,7 @@ spec:
                           description: User-defined set of parameters to use in the
                             memcache process.
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   memcacheVersion:
@@ -399,6 +404,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                 type: object
               managementPolicies:
                 default:
@@ -599,6 +605,7 @@ spec:
                       type: string
                     description: Resource labels to represent user-provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   maintenancePolicy:
                     description: Maintenance policy for an instance. Structure is
                       documented below.
@@ -738,6 +745,7 @@ spec:
                           description: User-defined set of parameters to use in the
                             memcache process.
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   memcacheVersion:
@@ -782,6 +790,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                 type: object
               conditions:
                 description: Conditions of the resource.
diff --git a/package/crds/mlengine.gcp.upbound.io_models.yaml b/package/crds/mlengine.gcp.upbound.io_models.yaml
index 07530710f..72c04f591 100644
--- a/package/crds/mlengine.gcp.upbound.io_models.yaml
+++ b/package/crds/mlengine.gcp.upbound.io_models.yaml
@@ -89,6 +89,7 @@ spec:
                     description: One or more labels that you can add, to organize
                       your models.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: The name specified for the model.
                     type: string
@@ -145,6 +146,7 @@ spec:
                     description: One or more labels that you can add, to organize
                       your models.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: The name specified for the model.
                     type: string
@@ -362,6 +364,7 @@ spec:
                     description: One or more labels that you can add, to organize
                       your models.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: The name specified for the model.
                     type: string
diff --git a/package/crds/monitoring.gcp.upbound.io_alertpolicies.yaml b/package/crds/monitoring.gcp.upbound.io_alertpolicies.yaml
index 45096249c..e9fed1656 100644
--- a/package/crds/monitoring.gcp.upbound.io_alertpolicies.yaml
+++ b/package/crds/monitoring.gcp.upbound.io_alertpolicies.yaml
@@ -300,6 +300,7 @@ spec:
                                   values can be used in notifications generated by
                                   this condition.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         conditionMonitoringQueryLanguage:
@@ -414,6 +415,7 @@ spec:
                                   intended to be used for organizing and identifying
                                   the AlertPolicy
                                 type: object
+                                x-kubernetes-map-type: granular
                               query:
                                 description: The PromQL expression to evaluate. Every
                                   evaluation cycle this expression is evaluated at
@@ -790,6 +792,7 @@ spec:
                       can contain only lowercase letters, numerals, underscores, and
                       dashes. Keys must begin with a letter.
                     type: object
+                    x-kubernetes-map-type: granular
                 type: object
               initProvider:
                 description: THIS IS A BETA FIELD. It will be honored unless the Management
@@ -1035,6 +1038,7 @@ spec:
                                   values can be used in notifications generated by
                                   this condition.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         conditionMonitoringQueryLanguage:
@@ -1149,6 +1153,7 @@ spec:
                                   intended to be used for organizing and identifying
                                   the AlertPolicy
                                 type: object
+                                x-kubernetes-map-type: granular
                               query:
                                 description: The PromQL expression to evaluate. Every
                                   evaluation cycle this expression is evaluated at
@@ -1525,6 +1530,7 @@ spec:
                       can contain only lowercase letters, numerals, underscores, and
                       dashes. Keys must begin with a letter.
                     type: object
+                    x-kubernetes-map-type: granular
                 type: object
               managementPolicies:
                 default:
@@ -1936,6 +1942,7 @@ spec:
                                   values can be used in notifications generated by
                                   this condition.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         conditionMonitoringQueryLanguage:
@@ -2050,6 +2057,7 @@ spec:
                                   intended to be used for organizing and identifying
                                   the AlertPolicy
                                 type: object
+                                x-kubernetes-map-type: granular
                               query:
                                 description: The PromQL expression to evaluate. Every
                                   evaluation cycle this expression is evaluated at
@@ -2455,6 +2463,7 @@ spec:
                       can contain only lowercase letters, numerals, underscores, and
                       dashes. Keys must begin with a letter.
                     type: object
+                    x-kubernetes-map-type: granular
                 type: object
               conditions:
                 description: Conditions of the resource.
diff --git a/package/crds/monitoring.gcp.upbound.io_customservices.yaml b/package/crds/monitoring.gcp.upbound.io_customservices.yaml
index 3315fd577..3e066260a 100644
--- a/package/crds/monitoring.gcp.upbound.io_customservices.yaml
+++ b/package/crds/monitoring.gcp.upbound.io_customservices.yaml
@@ -101,6 +101,7 @@ spec:
                       may be stored. For labels which do not have a semantic value,
                       the empty string may be supplied for the label value.
                     type: object
+                    x-kubernetes-map-type: granular
                 type: object
               initProvider:
                 description: THIS IS A BETA FIELD. It will be honored unless the Management
@@ -147,6 +148,7 @@ spec:
                       may be stored. For labels which do not have a semantic value,
                       the empty string may be supplied for the label value.
                     type: object
+                    x-kubernetes-map-type: granular
                 type: object
               managementPolicies:
                 default:
@@ -353,6 +355,7 @@ spec:
                       may be stored. For labels which do not have a semantic value,
                       the empty string may be supplied for the label value.
                     type: object
+                    x-kubernetes-map-type: granular
                 type: object
               conditions:
                 description: Conditions of the resource.
diff --git a/package/crds/monitoring.gcp.upbound.io_metricdescriptors.yaml b/package/crds/monitoring.gcp.upbound.io_metricdescriptors.yaml
index e51f9a4b5..663d91a45 100644
--- a/package/crds/monitoring.gcp.upbound.io_metricdescriptors.yaml
+++ b/package/crds/monitoring.gcp.upbound.io_metricdescriptors.yaml
@@ -556,6 +556,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   name:
                     description: The resource name of the metric descriptor.
                     type: string
diff --git a/package/crds/monitoring.gcp.upbound.io_notificationchannels.yaml b/package/crds/monitoring.gcp.upbound.io_notificationchannels.yaml
index 7642e6e06..5e0094ac7 100644
--- a/package/crds/monitoring.gcp.upbound.io_notificationchannels.yaml
+++ b/package/crds/monitoring.gcp.upbound.io_notificationchannels.yaml
@@ -106,6 +106,7 @@ spec:
                       field. They can also be configured via the sensitive_labels
                       block, but cannot be configured in both places.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -203,6 +204,7 @@ spec:
                       is smaller. Labels and values can contain only lowercase letters,
                       numerals, underscores, and dashes. Keys must begin with a letter.
                     type: object
+                    x-kubernetes-map-type: granular
                 type: object
               initProvider:
                 description: THIS IS A BETA FIELD. It will be honored unless the Management
@@ -254,6 +256,7 @@ spec:
                       field. They can also be configured via the sensitive_labels
                       block, but cannot be configured in both places.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -290,6 +293,7 @@ spec:
                       is smaller. Labels and values can contain only lowercase letters,
                       numerals, underscores, and dashes. Keys must begin with a letter.
                     type: object
+                    x-kubernetes-map-type: granular
                 type: object
               managementPolicies:
                 default:
@@ -502,6 +506,7 @@ spec:
                       field. They can also be configured via the sensitive_labels
                       block, but cannot be configured in both places.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: 'The full REST resource name for this channel. The
                       syntax is: projects/[PROJECT_ID]/notificationChannels/[CHANNEL_ID]
@@ -605,6 +610,7 @@ spec:
                       is smaller. Labels and values can contain only lowercase letters,
                       numerals, underscores, and dashes. Keys must begin with a letter.
                     type: object
+                    x-kubernetes-map-type: granular
                   verificationStatus:
                     description: Indicates whether this channel has been verified
                       or not. On a ListNotificationChannels or GetNotificationChannel
diff --git a/package/crds/monitoring.gcp.upbound.io_services.yaml b/package/crds/monitoring.gcp.upbound.io_services.yaml
index b9d629bb1..44cbd4498 100644
--- a/package/crds/monitoring.gcp.upbound.io_services.yaml
+++ b/package/crds/monitoring.gcp.upbound.io_services.yaml
@@ -82,6 +82,7 @@ spec:
                             the monitoring data which is used for SLO reporting of
                             this Service.
                           type: object
+                          x-kubernetes-map-type: granular
                         serviceType:
                           description: The type of service that this basic service
                             defines, e.g. APP_ENGINE service type
@@ -106,6 +107,7 @@ spec:
                       may be stored. For labels which do not have a semantic value,
                       the empty string may be supplied for the label value.
                     type: object
+                    x-kubernetes-map-type: granular
                 type: object
               initProvider:
                 description: THIS IS A BETA FIELD. It will be honored unless the Management
@@ -133,6 +135,7 @@ spec:
                             the monitoring data which is used for SLO reporting of
                             this Service.
                           type: object
+                          x-kubernetes-map-type: granular
                         serviceType:
                           description: The type of service that this basic service
                             defines, e.g. APP_ENGINE service type
@@ -157,6 +160,7 @@ spec:
                       may be stored. For labels which do not have a semantic value,
                       the empty string may be supplied for the label value.
                     type: object
+                    x-kubernetes-map-type: granular
                 type: object
               managementPolicies:
                 default:
@@ -337,6 +341,7 @@ spec:
                             the monitoring data which is used for SLO reporting of
                             this Service.
                           type: object
+                          x-kubernetes-map-type: granular
                         serviceType:
                           description: The type of service that this basic service
                             defines, e.g. APP_ENGINE service type
@@ -379,6 +384,7 @@ spec:
                       may be stored. For labels which do not have a semantic value,
                       the empty string may be supplied for the label value.
                     type: object
+                    x-kubernetes-map-type: granular
                 type: object
               conditions:
                 description: Conditions of the resource.
diff --git a/package/crds/monitoring.gcp.upbound.io_sloes.yaml b/package/crds/monitoring.gcp.upbound.io_sloes.yaml
index c7da8a6a5..d206c6448 100644
--- a/package/crds/monitoring.gcp.upbound.io_sloes.yaml
+++ b/package/crds/monitoring.gcp.upbound.io_sloes.yaml
@@ -112,6 +112,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         method:
                           description: An optional set of RPCs to which this SLI is
                             relevant. Telemetry from other methods will not be used
@@ -122,6 +123,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         version:
                           description: The set of API versions to which this SLI is
                             relevant. Telemetry from other API versions will not be
@@ -132,6 +134,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   calendarPeriod:
@@ -335,6 +338,7 @@ spec:
                       can contain only lowercase letters, numerals, underscores, and
                       dashes. Keys must begin with a letter.
                     type: object
+                    x-kubernetes-map-type: granular
                   windowsBasedSli:
                     description: 'A windows-based SLI defines the criteria for time
                       windows. good_service is defined based off the count of these
@@ -405,6 +409,7 @@ spec:
                                       items:
                                         type: string
                                       type: array
+                                      x-kubernetes-list-type: set
                                     method:
                                       description: An optional set of RPCs to which
                                         this SLI is relevant. Telemetry from other
@@ -417,6 +422,7 @@ spec:
                                       items:
                                         type: string
                                       type: array
+                                      x-kubernetes-list-type: set
                                     version:
                                       description: The set of API versions to which
                                         this SLI is relevant. Telemetry from other
@@ -429,6 +435,7 @@ spec:
                                       items:
                                         type: string
                                       type: array
+                                      x-kubernetes-list-type: set
                                   type: object
                                 type: array
                               performance:
@@ -677,6 +684,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         method:
                           description: An optional set of RPCs to which this SLI is
                             relevant. Telemetry from other methods will not be used
@@ -687,6 +695,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         version:
                           description: The set of API versions to which this SLI is
                             relevant. Telemetry from other API versions will not be
@@ -697,6 +706,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   calendarPeriod:
@@ -822,6 +832,7 @@ spec:
                       can contain only lowercase letters, numerals, underscores, and
                       dashes. Keys must begin with a letter.
                     type: object
+                    x-kubernetes-map-type: granular
                   windowsBasedSli:
                     description: 'A windows-based SLI defines the criteria for time
                       windows. good_service is defined based off the count of these
@@ -892,6 +903,7 @@ spec:
                                       items:
                                         type: string
                                       type: array
+                                      x-kubernetes-list-type: set
                                     method:
                                       description: An optional set of RPCs to which
                                         this SLI is relevant. Telemetry from other
@@ -904,6 +916,7 @@ spec:
                                       items:
                                         type: string
                                       type: array
+                                      x-kubernetes-list-type: set
                                     version:
                                       description: The set of API versions to which
                                         this SLI is relevant. Telemetry from other
@@ -916,6 +929,7 @@ spec:
                                       items:
                                         type: string
                                       type: array
+                                      x-kubernetes-list-type: set
                                   type: object
                                 type: array
                               performance:
@@ -1322,6 +1336,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         method:
                           description: An optional set of RPCs to which this SLI is
                             relevant. Telemetry from other methods will not be used
@@ -1332,6 +1347,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                         version:
                           description: The set of API versions to which this SLI is
                             relevant. Telemetry from other API versions will not be
@@ -1342,6 +1358,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   calendarPeriod:
@@ -1477,6 +1494,7 @@ spec:
                       can contain only lowercase letters, numerals, underscores, and
                       dashes. Keys must begin with a letter.
                     type: object
+                    x-kubernetes-map-type: granular
                   windowsBasedSli:
                     description: 'A windows-based SLI defines the criteria for time
                       windows. good_service is defined based off the count of these
@@ -1547,6 +1565,7 @@ spec:
                                       items:
                                         type: string
                                       type: array
+                                      x-kubernetes-list-type: set
                                     method:
                                       description: An optional set of RPCs to which
                                         this SLI is relevant. Telemetry from other
@@ -1559,6 +1578,7 @@ spec:
                                       items:
                                         type: string
                                       type: array
+                                      x-kubernetes-list-type: set
                                     version:
                                       description: The set of API versions to which
                                         this SLI is relevant. Telemetry from other
@@ -1571,6 +1591,7 @@ spec:
                                       items:
                                         type: string
                                       type: array
+                                      x-kubernetes-list-type: set
                                   type: object
                                 type: array
                               performance:
diff --git a/package/crds/monitoring.gcp.upbound.io_uptimecheckconfigs.yaml b/package/crds/monitoring.gcp.upbound.io_uptimecheckconfigs.yaml
index 5eb9dd275..997898792 100644
--- a/package/crds/monitoring.gcp.upbound.io_uptimecheckconfigs.yaml
+++ b/package/crds/monitoring.gcp.upbound.io_uptimecheckconfigs.yaml
@@ -203,6 +203,7 @@ spec:
                             by the second. The maximum number of headers allowed is
                             100.
                           type: object
+                          x-kubernetes-map-type: granular
                         maskHeaders:
                           description: Boolean specifying whether to encrypt the header
                             information. Encryption should be specified for any headers
@@ -260,6 +261,7 @@ spec:
                             Compute Engine VM instances use the labels "project_id",
                             "instance_id", and "zone".
                           type: object
+                          x-kubernetes-map-type: granular
                         type:
                           description: The monitored resource type. This field must
                             match the type field of a MonitoredResourceDescriptor
@@ -529,6 +531,7 @@ spec:
                             by the second. The maximum number of headers allowed is
                             100.
                           type: object
+                          x-kubernetes-map-type: granular
                         maskHeaders:
                           description: Boolean specifying whether to encrypt the header
                             information. Encryption should be specified for any headers
@@ -586,6 +589,7 @@ spec:
                             Compute Engine VM instances use the labels "project_id",
                             "instance_id", and "zone".
                           type: object
+                          x-kubernetes-map-type: granular
                         type:
                           description: The monitored resource type. This field must
                             match the type field of a MonitoredResourceDescriptor
@@ -935,6 +939,7 @@ spec:
                             by the second. The maximum number of headers allowed is
                             100.
                           type: object
+                          x-kubernetes-map-type: granular
                         maskHeaders:
                           description: Boolean specifying whether to encrypt the header
                             information. Encryption should be specified for any headers
@@ -995,6 +1000,7 @@ spec:
                             Compute Engine VM instances use the labels "project_id",
                             "instance_id", and "zone".
                           type: object
+                          x-kubernetes-map-type: granular
                         type:
                           description: The monitored resource type. This field must
                             match the type field of a MonitoredResourceDescriptor
diff --git a/package/crds/networkconnectivity.gcp.upbound.io_hubs.yaml b/package/crds/networkconnectivity.gcp.upbound.io_hubs.yaml
index aa7d5d7c1..a0d01e805 100644
--- a/package/crds/networkconnectivity.gcp.upbound.io_hubs.yaml
+++ b/package/crds/networkconnectivity.gcp.upbound.io_hubs.yaml
@@ -76,6 +76,7 @@ spec:
                     description: Optional labels in key:value format. For more information
                       about labels, see Requirements for labels.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: 'Immutable. The name of the hub. Hub names must be
                       unique. They use the following form: projects/{project_number}/locations/global/hubs/{hub_id}'
@@ -105,6 +106,7 @@ spec:
                     description: Optional labels in key:value format. For more information
                       about labels, see Requirements for labels.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: 'Immutable. The name of the hub. Hub names must be
                       unique. They use the following form: projects/{project_number}/locations/global/hubs/{hub_id}'
@@ -298,6 +300,7 @@ spec:
                     description: Optional labels in key:value format. For more information
                       about labels, see Requirements for labels.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: 'Immutable. The name of the hub. Hub names must be
                       unique. They use the following form: projects/{project_number}/locations/global/hubs/{hub_id}'
diff --git a/package/crds/networkconnectivity.gcp.upbound.io_spokes.yaml b/package/crds/networkconnectivity.gcp.upbound.io_spokes.yaml
index 607faa025..9a2de9665 100644
--- a/package/crds/networkconnectivity.gcp.upbound.io_spokes.yaml
+++ b/package/crds/networkconnectivity.gcp.upbound.io_spokes.yaml
@@ -155,6 +155,7 @@ spec:
                     description: Optional labels in key:value format. For more information
                       about labels, see Requirements for labels.
                     type: object
+                    x-kubernetes-map-type: granular
                   linkedInterconnectAttachments:
                     description: A collection of VLAN attachment resources. These
                       resources should be redundant attachments that all advertise
@@ -327,6 +328,7 @@ spec:
                     description: Optional labels in key:value format. For more information
                       about labels, see Requirements for labels.
                     type: object
+                    x-kubernetes-map-type: granular
                   linkedInterconnectAttachments:
                     description: A collection of VLAN attachment resources. These
                       resources should be redundant attachments that all advertise
@@ -588,6 +590,7 @@ spec:
                     description: Optional labels in key:value format. For more information
                       about labels, see Requirements for labels.
                     type: object
+                    x-kubernetes-map-type: granular
                   linkedInterconnectAttachments:
                     description: A collection of VLAN attachment resources. These
                       resources should be redundant attachments that all advertise
diff --git a/package/crds/networkmanagement.gcp.upbound.io_connectivitytests.yaml b/package/crds/networkmanagement.gcp.upbound.io_connectivitytests.yaml
index 552907c41..ced1ab335 100644
--- a/package/crds/networkmanagement.gcp.upbound.io_connectivitytests.yaml
+++ b/package/crds/networkmanagement.gcp.upbound.io_connectivitytests.yaml
@@ -430,6 +430,7 @@ spec:
                       type: string
                     description: Resource labels to represent user-provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: Unique name for the connectivity test.
                     type: string
@@ -851,6 +852,7 @@ spec:
                       type: string
                     description: Resource labels to represent user-provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: Unique name for the connectivity test.
                     type: string
@@ -1129,6 +1131,7 @@ spec:
                       type: string
                     description: Resource labels to represent user-provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: Unique name for the connectivity test.
                     type: string
diff --git a/package/crds/notebooks.gcp.upbound.io_instances.yaml b/package/crds/notebooks.gcp.upbound.io_instances.yaml
index f09dd1d79..d45137a0d 100644
--- a/package/crds/notebooks.gcp.upbound.io_instances.yaml
+++ b/package/crds/notebooks.gcp.upbound.io_instances.yaml
@@ -158,6 +158,7 @@ spec:
                       of "key": value pairs. Example: { "name": "wrench", "mass":
                       "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: A reference to the zone where the machine resides.
                     type: string
@@ -171,6 +172,7 @@ spec:
                       containing a list of "key": value pairs. Example: { "name":
                       "wrench", "mass": "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   network:
                     description: 'The name of the VPC that this instance is in. Format:
                       projects/{project_id}/global/networks/{network_id}'
@@ -394,6 +396,7 @@ spec:
                       of "key": value pairs. Example: { "name": "wrench", "mass":
                       "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   machineType:
                     description: A reference to a machine type which defines VM kind.
                     type: string
@@ -404,6 +407,7 @@ spec:
                       containing a list of "key": value pairs. Example: { "name":
                       "wrench", "mass": "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   network:
                     description: 'The name of the VPC that this instance is in. Format:
                       projects/{project_id}/global/networks/{network_id}'
@@ -789,6 +793,7 @@ spec:
                       of "key": value pairs. Example: { "name": "wrench", "mass":
                       "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: A reference to the zone where the machine resides.
                     type: string
@@ -802,6 +807,7 @@ spec:
                       containing a list of "key": value pairs. Example: { "name":
                       "wrench", "mass": "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   network:
                     description: 'The name of the VPC that this instance is in. Format:
                       projects/{project_id}/global/networks/{network_id}'
diff --git a/package/crds/notebooks.gcp.upbound.io_runtimes.yaml b/package/crds/notebooks.gcp.upbound.io_runtimes.yaml
index 9803a7e72..32f8a3945 100644
--- a/package/crds/notebooks.gcp.upbound.io_runtimes.yaml
+++ b/package/crds/notebooks.gcp.upbound.io_runtimes.yaml
@@ -243,6 +243,7 @@ spec:
                                               must conform to RFC 1035. No more than
                                               32 labels can be associated with a cluster.
                                             type: object
+                                            x-kubernetes-map-type: granular
                                         type: object
                                       type: array
                                     interface:
@@ -308,6 +309,7 @@ spec:
                                   RFC 1035. No more than 32 labels can be associated
                                   with a cluster.
                                 type: object
+                                x-kubernetes-map-type: granular
                               machineType:
                                 description: The Compute Engine machine type used
                                   for runtimes.
@@ -320,6 +322,7 @@ spec:
                                   metadata](https://cloud.google.com /compute/docs/storing-retrieving-metadata#project_and_instance
                                   _metadata)).
                                 type: object
+                                x-kubernetes-map-type: granular
                               network:
                                 description: 'The Compute Engine network to be used
                                   for machine communications. Cannot be specified
@@ -573,6 +576,7 @@ spec:
                                               must conform to RFC 1035. No more than
                                               32 labels can be associated with a cluster.
                                             type: object
+                                            x-kubernetes-map-type: granular
                                         type: object
                                       type: array
                                     interface:
@@ -638,6 +642,7 @@ spec:
                                   RFC 1035. No more than 32 labels can be associated
                                   with a cluster.
                                 type: object
+                                x-kubernetes-map-type: granular
                               machineType:
                                 description: The Compute Engine machine type used
                                   for runtimes.
@@ -650,6 +655,7 @@ spec:
                                   metadata](https://cloud.google.com /compute/docs/storing-retrieving-metadata#project_and_instance
                                   _metadata)).
                                 type: object
+                                x-kubernetes-map-type: granular
                               network:
                                 description: 'The Compute Engine network to be used
                                   for machine communications. Cannot be specified
@@ -924,6 +930,7 @@ spec:
                           description: (Output) Contains runtime daemon metrics, such
                             as OS and kernels and sessions stats.
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                   project:
@@ -1140,6 +1147,7 @@ spec:
                                               must conform to RFC 1035. No more than
                                               32 labels can be associated with a cluster.
                                             type: object
+                                            x-kubernetes-map-type: granular
                                         type: object
                                       type: array
                                     interface:
@@ -1201,6 +1209,7 @@ spec:
                                   (see [Project and instance guest attributes](https://cloud.google.com/compute/docs/
                                   storing-retrieving-metadata#guest_attributes)).
                                 type: object
+                                x-kubernetes-map-type: granular
                               internalIpOnly:
                                 description: If true, runtime will only have internal
                                   IP addresses. By default, runtimes are not restricted
@@ -1222,6 +1231,7 @@ spec:
                                   RFC 1035. No more than 32 labels can be associated
                                   with a cluster.
                                 type: object
+                                x-kubernetes-map-type: granular
                               machineType:
                                 description: The Compute Engine machine type used
                                   for runtimes.
@@ -1234,6 +1244,7 @@ spec:
                                   metadata](https://cloud.google.com /compute/docs/storing-retrieving-metadata#project_and_instance
                                   _metadata)).
                                 type: object
+                                x-kubernetes-map-type: granular
                               network:
                                 description: 'The Compute Engine network to be used
                                   for machine communications. Cannot be specified
diff --git a/package/crds/osconfig.gcp.upbound.io_ospolicyassignments.yaml b/package/crds/osconfig.gcp.upbound.io_ospolicyassignments.yaml
index fe05ce73c..f5104e21a 100644
--- a/package/crds/osconfig.gcp.upbound.io_ospolicyassignments.yaml
+++ b/package/crds/osconfig.gcp.upbound.io_ospolicyassignments.yaml
@@ -93,6 +93,7 @@ spec:
                                   in this map. A VM should contain all the key/value
                                   pairs specified in this map to be selected.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         inclusionLabels:
@@ -109,6 +110,7 @@ spec:
                                   in this map. A VM should contain all the key/value
                                   pairs specified in this map to be selected.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         inventories:
@@ -1000,6 +1002,7 @@ spec:
                                   in this map. A VM should contain all the key/value
                                   pairs specified in this map to be selected.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         inclusionLabels:
@@ -1016,6 +1019,7 @@ spec:
                                   in this map. A VM should contain all the key/value
                                   pairs specified in this map to be selected.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         inventories:
@@ -2085,6 +2089,7 @@ spec:
                                   in this map. A VM should contain all the key/value
                                   pairs specified in this map to be selected.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         inclusionLabels:
@@ -2101,6 +2106,7 @@ spec:
                                   in this map. A VM should contain all the key/value
                                   pairs specified in this map to be selected.
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         inventories:
diff --git a/package/crds/osconfig.gcp.upbound.io_patchdeployments.yaml b/package/crds/osconfig.gcp.upbound.io_patchdeployments.yaml
index 49a204b89..71a5fe253 100644
--- a/package/crds/osconfig.gcp.upbound.io_patchdeployments.yaml
+++ b/package/crds/osconfig.gcp.upbound.io_patchdeployments.yaml
@@ -98,6 +98,7 @@ spec:
                                   be present for a VM instance to be targeted by this
                                   filter
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         instanceNamePrefixes:
@@ -697,6 +698,7 @@ spec:
                                   be present for a VM instance to be targeted by this
                                   filter
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         instanceNamePrefixes:
@@ -1462,6 +1464,7 @@ spec:
                                   be present for a VM instance to be targeted by this
                                   filter
                                 type: object
+                                x-kubernetes-map-type: granular
                             type: object
                           type: array
                         instanceNamePrefixes:
diff --git a/package/crds/privateca.gcp.upbound.io_capools.yaml b/package/crds/privateca.gcp.upbound.io_capools.yaml
index ef7b2f22a..dbc2f6fdc 100644
--- a/package/crds/privateca.gcp.upbound.io_capools.yaml
+++ b/package/crds/privateca.gcp.upbound.io_capools.yaml
@@ -493,6 +493,7 @@ spec:
                       a list of "key": value pairs. Example: { "name": "wrench", "mass":
                       "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: Location of the CaPool. A full list of valid locations
                       can be found by running gcloud privateca locations list.
@@ -973,6 +974,7 @@ spec:
                       a list of "key": value pairs. Example: { "name": "wrench", "mass":
                       "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -1613,6 +1615,7 @@ spec:
                       a list of "key": value pairs. Example: { "name": "wrench", "mass":
                       "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: Location of the CaPool. A full list of valid locations
                       can be found by running gcloud privateca locations list.
diff --git a/package/crds/privateca.gcp.upbound.io_certificateauthorities.yaml b/package/crds/privateca.gcp.upbound.io_certificateauthorities.yaml
index b5c6b27b6..5f80128c1 100644
--- a/package/crds/privateca.gcp.upbound.io_certificateauthorities.yaml
+++ b/package/crds/privateca.gcp.upbound.io_certificateauthorities.yaml
@@ -489,6 +489,7 @@ spec:
                       a list of "key": value pairs. Example: { "name": "wrench", "mass":
                       "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   lifetime:
                     description: 'The desired lifetime of the CA certificate. Used
                       to create the "notBeforeTime" and "notAfterTime" fields inside
@@ -1142,6 +1143,7 @@ spec:
                       a list of "key": value pairs. Example: { "name": "wrench", "mass":
                       "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   lifetime:
                     description: 'The desired lifetime of the CA certificate. Used
                       to create the "notBeforeTime" and "notAfterTime" fields inside
@@ -1819,6 +1821,7 @@ spec:
                       a list of "key": value pairs. Example: { "name": "wrench", "mass":
                       "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   lifetime:
                     description: 'The desired lifetime of the CA certificate. Used
                       to create the "notBeforeTime" and "notAfterTime" fields inside
diff --git a/package/crds/privateca.gcp.upbound.io_certificates.yaml b/package/crds/privateca.gcp.upbound.io_certificates.yaml
index bacc5ea2a..098c37e07 100644
--- a/package/crds/privateca.gcp.upbound.io_certificates.yaml
+++ b/package/crds/privateca.gcp.upbound.io_certificates.yaml
@@ -643,6 +643,7 @@ spec:
                     description: Labels with user-defined metadata to apply to this
                       resource.
                     type: object
+                    x-kubernetes-map-type: granular
                   lifetime:
                     description: 'The desired lifetime of the CA certificate. Used
                       to create the "notBeforeTime" and "notAfterTime" fields inside
@@ -1142,6 +1143,7 @@ spec:
                     description: Labels with user-defined metadata to apply to this
                       resource.
                     type: object
+                    x-kubernetes-map-type: granular
                   lifetime:
                     description: 'The desired lifetime of the CA certificate. Used
                       to create the "notBeforeTime" and "notAfterTime" fields inside
@@ -2355,6 +2357,7 @@ spec:
                     description: Labels with user-defined metadata to apply to this
                       resource.
                     type: object
+                    x-kubernetes-map-type: granular
                   lifetime:
                     description: 'The desired lifetime of the CA certificate. Used
                       to create the "notBeforeTime" and "notAfterTime" fields inside
diff --git a/package/crds/privateca.gcp.upbound.io_certificatetemplates.yaml b/package/crds/privateca.gcp.upbound.io_certificatetemplates.yaml
index acd67db43..9982c527d 100644
--- a/package/crds/privateca.gcp.upbound.io_certificatetemplates.yaml
+++ b/package/crds/privateca.gcp.upbound.io_certificatetemplates.yaml
@@ -126,6 +126,7 @@ spec:
                       type: string
                     description: Optional. Labels with user-defined metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The location for the resource
                     type: string
@@ -416,6 +417,7 @@ spec:
                       type: string
                     description: Optional. Labels with user-defined metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   passthroughExtensions:
                     description: Optional. Describes the set of X.509 extensions that
                       may appear in a Certificate issued using this CertificateTemplate.
@@ -864,6 +866,7 @@ spec:
                       type: string
                     description: Optional. Labels with user-defined metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   location:
                     description: The location for the resource
                     type: string
diff --git a/package/crds/pubsub.gcp.upbound.io_subscriptions.yaml b/package/crds/pubsub.gcp.upbound.io_subscriptions.yaml
index 9c4ed0139..6bd84e62f 100644
--- a/package/crds/pubsub.gcp.upbound.io_subscriptions.yaml
+++ b/package/crds/pubsub.gcp.upbound.io_subscriptions.yaml
@@ -275,6 +275,7 @@ spec:
                     description: A set of key/value label pairs to assign to this
                       Subscription.
                     type: object
+                    x-kubernetes-map-type: granular
                   messageRetentionDuration:
                     description: 'How long to retain unacknowledged messages in the
                       subscription''s backlog, from the moment a message is published.
@@ -316,6 +317,7 @@ spec:
                             subscription was created without this attribute. The possible
                             values for this attribute are:'
                           type: object
+                          x-kubernetes-map-type: granular
                         noWrapper:
                           description: When set, the payload to the push endpoint
                             is not wrapped.Sets the data field as the HTTP body for
@@ -602,6 +604,7 @@ spec:
                     description: A set of key/value label pairs to assign to this
                       Subscription.
                     type: object
+                    x-kubernetes-map-type: granular
                   messageRetentionDuration:
                     description: 'How long to retain unacknowledged messages in the
                       subscription''s backlog, from the moment a message is published.
@@ -643,6 +646,7 @@ spec:
                             subscription was created without this attribute. The possible
                             values for this attribute are:'
                           type: object
+                          x-kubernetes-map-type: granular
                         noWrapper:
                           description: When set, the payload to the push endpoint
                             is not wrapped.Sets the data field as the HTTP body for
@@ -1020,6 +1024,7 @@ spec:
                     description: A set of key/value label pairs to assign to this
                       Subscription.
                     type: object
+                    x-kubernetes-map-type: granular
                   messageRetentionDuration:
                     description: 'How long to retain unacknowledged messages in the
                       subscription''s backlog, from the moment a message is published.
@@ -1061,6 +1066,7 @@ spec:
                             subscription was created without this attribute. The possible
                             values for this attribute are:'
                           type: object
+                          x-kubernetes-map-type: granular
                         noWrapper:
                           description: When set, the payload to the push endpoint
                             is not wrapped.Sets the data field as the HTTP body for
diff --git a/package/crds/pubsub.gcp.upbound.io_topics.yaml b/package/crds/pubsub.gcp.upbound.io_topics.yaml
index 0fd595731..409859796 100644
--- a/package/crds/pubsub.gcp.upbound.io_topics.yaml
+++ b/package/crds/pubsub.gcp.upbound.io_topics.yaml
@@ -153,6 +153,7 @@ spec:
                     description: A set of key/value label pairs to assign to this
                       Topic.
                     type: object
+                    x-kubernetes-map-type: granular
                   messageRetentionDuration:
                     description: Indicates the minimum duration to retain a message
                       after it is published to the topic. If this field is set, messages
@@ -224,6 +225,7 @@ spec:
                     description: A set of key/value label pairs to assign to this
                       Topic.
                     type: object
+                    x-kubernetes-map-type: granular
                   messageRetentionDuration:
                     description: Indicates the minimum duration to retain a message
                       after it is published to the topic. If this field is set, messages
@@ -458,6 +460,7 @@ spec:
                     description: A set of key/value label pairs to assign to this
                       Topic.
                     type: object
+                    x-kubernetes-map-type: granular
                   messageRetentionDuration:
                     description: Indicates the minimum duration to retain a message
                       after it is published to the topic. If this field is set, messages
diff --git a/package/crds/redis.gcp.upbound.io_instances.yaml b/package/crds/redis.gcp.upbound.io_instances.yaml
index 4e1196d52..bb5677b9a 100644
--- a/package/crds/redis.gcp.upbound.io_instances.yaml
+++ b/package/crds/redis.gcp.upbound.io_instances.yaml
@@ -175,6 +175,7 @@ spec:
                       type: string
                     description: Resource labels to represent user provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   locationId:
                     description: The zone where the instance will be provisioned.
                       If not provided, the service will choose a zone for the instance.
@@ -275,6 +276,7 @@ spec:
                       Please check Memorystore documentation for the list of supported
                       parameters: https://cloud.google.com/memorystore/docs/redis/reference/rest/v1/projects.locations.instances#Instance.FIELDS.redis_configs'
                     type: object
+                    x-kubernetes-map-type: granular
                   redisVersion:
                     description: The version of Redis software. If not provided, latest
                       supported version will be used. Please check the API documentation
@@ -359,6 +361,7 @@ spec:
                       type: string
                     description: Resource labels to represent user provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   locationId:
                     description: The zone where the instance will be provisioned.
                       If not provided, the service will choose a zone for the instance.
@@ -459,6 +462,7 @@ spec:
                       Please check Memorystore documentation for the list of supported
                       parameters: https://cloud.google.com/memorystore/docs/redis/reference/rest/v1/projects.locations.instances#Instance.FIELDS.redis_configs'
                     type: object
+                    x-kubernetes-map-type: granular
                   redisVersion:
                     description: The version of Redis software. If not provided, latest
                       supported version will be used. Please check the API documentation
@@ -719,6 +723,7 @@ spec:
                       type: string
                     description: Resource labels to represent user provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   locationId:
                     description: The zone where the instance will be provisioned.
                       If not provided, the service will choose a zone for the instance.
@@ -903,6 +908,7 @@ spec:
                       Please check Memorystore documentation for the list of supported
                       parameters: https://cloud.google.com/memorystore/docs/redis/reference/rest/v1/projects.locations.instances#Instance.FIELDS.redis_configs'
                     type: object
+                    x-kubernetes-map-type: granular
                   redisVersion:
                     description: The version of Redis software. If not provided, latest
                       supported version will be used. Please check the API documentation
diff --git a/package/crds/secretmanager.gcp.upbound.io_secrets.yaml b/package/crds/secretmanager.gcp.upbound.io_secrets.yaml
index ee212c2be..c4eafdca8 100644
--- a/package/crds/secretmanager.gcp.upbound.io_secrets.yaml
+++ b/package/crds/secretmanager.gcp.upbound.io_secrets.yaml
@@ -88,6 +88,7 @@ spec:
                       a list of "key": value pairs. Example: { "name": "wrench", "mass":
                       "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -210,6 +211,7 @@ spec:
                       a list of "key": value pairs. Example: { "name": "wrench", "mass":
                       "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -496,6 +498,7 @@ spec:
                       a list of "key": value pairs. Example: { "name": "wrench", "mass":
                       "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: 'The resource name of the Secret. Format: projects/{{project}}/secrets/{{secret_id}}'
                     type: string
diff --git a/package/crds/spanner.gcp.upbound.io_instances.yaml b/package/crds/spanner.gcp.upbound.io_instances.yaml
index d3a7c2218..987f0ff86 100644
--- a/package/crds/spanner.gcp.upbound.io_instances.yaml
+++ b/package/crds/spanner.gcp.upbound.io_instances.yaml
@@ -92,6 +92,7 @@ spec:
                     description: 'An object containing a list of "key": value pairs.
                       Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   numNodes:
                     description: The number of nodes allocated to this instance.
                     type: number
@@ -141,6 +142,7 @@ spec:
                     description: 'An object containing a list of "key": value pairs.
                       Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   numNodes:
                     description: The number of nodes allocated to this instance.
                     type: number
@@ -355,6 +357,7 @@ spec:
                     description: 'An object containing a list of "key": value pairs.
                       Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.'
                     type: object
+                    x-kubernetes-map-type: granular
                   numNodes:
                     description: The number of nodes allocated to this instance.
                     type: number
diff --git a/package/crds/sql.gcp.upbound.io_databaseinstances.yaml b/package/crds/sql.gcp.upbound.io_databaseinstances.yaml
index 9ad07df4e..efe081da6 100644
--- a/package/crds/sql.gcp.upbound.io_databaseinstances.yaml
+++ b/package/crds/sql.gcp.upbound.io_databaseinstances.yaml
@@ -677,6 +677,7 @@ spec:
                           description: A set of key/value user label pairs to assign
                             to the instance.
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                 type: object
@@ -1179,6 +1180,7 @@ spec:
                           description: A set of key/value user label pairs to assign
                             to the instance.
                           type: object
+                          x-kubernetes-map-type: granular
                       type: object
                     type: array
                 type: object
@@ -1919,6 +1921,7 @@ spec:
                           description: A set of key/value user label pairs to assign
                             to the instance.
                           type: object
+                          x-kubernetes-map-type: granular
                         version:
                           description: Used to make sure changes to the settings block
                             are atomic.
diff --git a/package/crds/storage.gcp.upbound.io_bucketobjects.yaml b/package/crds/storage.gcp.upbound.io_bucketobjects.yaml
index 9f27ce651..ab35be8c8 100644
--- a/package/crds/storage.gcp.upbound.io_bucketobjects.yaml
+++ b/package/crds/storage.gcp.upbound.io_bucketobjects.yaml
@@ -218,6 +218,7 @@ spec:
                       type: string
                     description: User-provided metadata, in key/value pairs.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: The name of the object. If you're interpolating the
                       name of this object, see output_name instead.
@@ -305,6 +306,7 @@ spec:
                       type: string
                     description: User-provided metadata, in key/value pairs.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: The name of the object. If you're interpolating the
                       name of this object, see output_name instead.
@@ -564,6 +566,7 @@ spec:
                       type: string
                     description: User-provided metadata, in key/value pairs.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: The name of the object. If you're interpolating the
                       name of this object, see output_name instead.
diff --git a/package/crds/storage.gcp.upbound.io_buckets.yaml b/package/crds/storage.gcp.upbound.io_buckets.yaml
index e2673786a..73db0a4e6 100644
--- a/package/crds/storage.gcp.upbound.io_buckets.yaml
+++ b/package/crds/storage.gcp.upbound.io_buckets.yaml
@@ -128,6 +128,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   defaultEventBasedHold:
@@ -157,6 +158,7 @@ spec:
                       type: string
                     description: A map of key/value label pairs to assign to the bucket.
                     type: object
+                    x-kubernetes-map-type: granular
                   lifecycleRule:
                     description: The bucket's Lifecycle Rules configuration. Multiple
                       blocks of this type are permitted. Structure is documented below.
@@ -411,6 +413,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   defaultEventBasedHold:
@@ -440,6 +443,7 @@ spec:
                       type: string
                     description: A map of key/value label pairs to assign to the bucket.
                     type: object
+                    x-kubernetes-map-type: granular
                   lifecycleRule:
                     description: The bucket's Lifecycle Rules configuration. Multiple
                       blocks of this type are permitted. Structure is documented below.
@@ -852,6 +856,7 @@ spec:
                           items:
                             type: string
                           type: array
+                          x-kubernetes-list-type: set
                       type: object
                     type: array
                   defaultEventBasedHold:
@@ -883,6 +888,7 @@ spec:
                       type: string
                     description: A map of key/value label pairs to assign to the bucket.
                     type: object
+                    x-kubernetes-map-type: granular
                   lifecycleRule:
                     description: The bucket's Lifecycle Rules configuration. Multiple
                       blocks of this type are permitted. Structure is documented below.
diff --git a/package/crds/storage.gcp.upbound.io_defaultobjectacls.yaml b/package/crds/storage.gcp.upbound.io_defaultobjectacls.yaml
index 15e923db0..819280af2 100644
--- a/package/crds/storage.gcp.upbound.io_defaultobjectacls.yaml
+++ b/package/crds/storage.gcp.upbound.io_defaultobjectacls.yaml
@@ -151,6 +151,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                 type: object
               initProvider:
                 description: THIS IS A BETA FIELD. It will be honored unless the Management
@@ -171,6 +172,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                 type: object
               managementPolicies:
                 default:
@@ -349,6 +351,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                 type: object
               conditions:
                 description: Conditions of the resource.
diff --git a/package/crds/storage.gcp.upbound.io_notifications.yaml b/package/crds/storage.gcp.upbound.io_notifications.yaml
index c4a0ae896..b8ba3b087 100644
--- a/package/crds/storage.gcp.upbound.io_notifications.yaml
+++ b/package/crds/storage.gcp.upbound.io_notifications.yaml
@@ -149,6 +149,7 @@ spec:
                     description: A set of key/value attribute pairs to attach to each
                       Cloud PubSub message published for this notification subscription
                     type: object
+                    x-kubernetes-map-type: granular
                   eventTypes:
                     description: 'List of event type filters for this notification
                       config. If not specified, Cloud Storage will send notifications
@@ -157,6 +158,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   objectNamePrefix:
                     description: Specifies a prefix path filter for this notification
                       config. Cloud Storage will only send notifications for objects
@@ -266,6 +268,7 @@ spec:
                     description: A set of key/value attribute pairs to attach to each
                       Cloud PubSub message published for this notification subscription
                     type: object
+                    x-kubernetes-map-type: granular
                   eventTypes:
                     description: 'List of event type filters for this notification
                       config. If not specified, Cloud Storage will send notifications
@@ -274,6 +277,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   objectNamePrefix:
                     description: Specifies a prefix path filter for this notification
                       config. Cloud Storage will only send notifications for objects
@@ -463,6 +467,7 @@ spec:
                     description: A set of key/value attribute pairs to attach to each
                       Cloud PubSub message published for this notification subscription
                     type: object
+                    x-kubernetes-map-type: granular
                   eventTypes:
                     description: 'List of event type filters for this notification
                       config. If not specified, Cloud Storage will send notifications
@@ -471,6 +476,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                   id:
                     type: string
                   notificationId:
diff --git a/package/crds/storage.gcp.upbound.io_objectacls.yaml b/package/crds/storage.gcp.upbound.io_objectacls.yaml
index abddd06b6..cc9ef0ab0 100644
--- a/package/crds/storage.gcp.upbound.io_objectacls.yaml
+++ b/package/crds/storage.gcp.upbound.io_objectacls.yaml
@@ -232,6 +232,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                 type: object
               initProvider:
                 description: THIS IS A BETA FIELD. It will be honored unless the Management
@@ -256,6 +257,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                 type: object
               managementPolicies:
                 default:
@@ -441,6 +443,7 @@ spec:
                     items:
                       type: string
                     type: array
+                    x-kubernetes-list-type: set
                 type: object
               conditions:
                 description: Conditions of the resource.
diff --git a/package/crds/tpu.gcp.upbound.io_nodes.yaml b/package/crds/tpu.gcp.upbound.io_nodes.yaml
index b01a46e19..27445439d 100644
--- a/package/crds/tpu.gcp.upbound.io_nodes.yaml
+++ b/package/crds/tpu.gcp.upbound.io_nodes.yaml
@@ -90,6 +90,7 @@ spec:
                       type: string
                     description: Resource labels to represent user provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   network:
                     description: The name of a network to peer the TPU node to. It
                       must be a preexisting Compute Engine network inside of the project
@@ -239,6 +240,7 @@ spec:
                       type: string
                     description: Resource labels to represent user provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -466,6 +468,7 @@ spec:
                       type: string
                     description: Resource labels to represent user provided metadata.
                     type: object
+                    x-kubernetes-map-type: granular
                   network:
                     description: The name of a network to peer the TPU node to. It
                       must be a preexisting Compute Engine network inside of the project
diff --git a/package/crds/vertexai.gcp.upbound.io_datasets.yaml b/package/crds/vertexai.gcp.upbound.io_datasets.yaml
index 1a3f2d1d5..8591ae704 100644
--- a/package/crds/vertexai.gcp.upbound.io_datasets.yaml
+++ b/package/crds/vertexai.gcp.upbound.io_datasets.yaml
@@ -93,6 +93,7 @@ spec:
                     description: A set of key/value label pairs to assign to this
                       Workflow.
                     type: object
+                    x-kubernetes-map-type: granular
                   metadataSchemaUri:
                     description: Points to a YAML file stored on Google Cloud Storage
                       describing additional information about the Dataset. The schema
@@ -145,6 +146,7 @@ spec:
                     description: A set of key/value label pairs to assign to this
                       Workflow.
                     type: object
+                    x-kubernetes-map-type: granular
                   metadataSchemaUri:
                     description: Points to a YAML file stored on Google Cloud Storage
                       describing additional information about the Dataset. The schema
@@ -367,6 +369,7 @@ spec:
                     description: A set of key/value label pairs to assign to this
                       Workflow.
                     type: object
+                    x-kubernetes-map-type: granular
                   metadataSchemaUri:
                     description: Points to a YAML file stored on Google Cloud Storage
                       describing additional information about the Dataset. The schema
diff --git a/package/crds/vertexai.gcp.upbound.io_featurestoreentitytypes.yaml b/package/crds/vertexai.gcp.upbound.io_featurestoreentitytypes.yaml
index 51fc935a5..a789ae230 100644
--- a/package/crds/vertexai.gcp.upbound.io_featurestoreentitytypes.yaml
+++ b/package/crds/vertexai.gcp.upbound.io_featurestoreentitytypes.yaml
@@ -156,6 +156,7 @@ spec:
                     description: A set of key/value label pairs to assign to this
                       EntityType.
                     type: object
+                    x-kubernetes-map-type: granular
                   monitoringConfig:
                     description: The default monitoring configuration for all Features
                       under this EntityType. If this is populated with [FeaturestoreMonitoringConfig.monitoring_interval]
@@ -279,6 +280,7 @@ spec:
                     description: A set of key/value label pairs to assign to this
                       EntityType.
                     type: object
+                    x-kubernetes-map-type: granular
                   monitoringConfig:
                     description: The default monitoring configuration for all Features
                       under this EntityType. If this is populated with [FeaturestoreMonitoringConfig.monitoring_interval]
@@ -571,6 +573,7 @@ spec:
                     description: A set of key/value label pairs to assign to this
                       EntityType.
                     type: object
+                    x-kubernetes-map-type: granular
                   monitoringConfig:
                     description: The default monitoring configuration for all Features
                       under this EntityType. If this is populated with [FeaturestoreMonitoringConfig.monitoring_interval]
diff --git a/package/crds/vertexai.gcp.upbound.io_featurestores.yaml b/package/crds/vertexai.gcp.upbound.io_featurestores.yaml
index e2e9ce544..3c8f2eb20 100644
--- a/package/crds/vertexai.gcp.upbound.io_featurestores.yaml
+++ b/package/crds/vertexai.gcp.upbound.io_featurestores.yaml
@@ -91,6 +91,7 @@ spec:
                     description: A set of key/value label pairs to assign to this
                       Featurestore.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: The name of the Featurestore. This value may be up
                       to 60 characters, and valid characters are [a-z0-9_]. The first
@@ -169,6 +170,7 @@ spec:
                     description: A set of key/value label pairs to assign to this
                       Featurestore.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: The name of the Featurestore. This value may be up
                       to 60 characters, and valid characters are [a-z0-9_]. The first
@@ -411,6 +413,7 @@ spec:
                     description: A set of key/value label pairs to assign to this
                       Featurestore.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: The name of the Featurestore. This value may be up
                       to 60 characters, and valid characters are [a-z0-9_]. The first
diff --git a/package/crds/vertexai.gcp.upbound.io_tensorboards.yaml b/package/crds/vertexai.gcp.upbound.io_tensorboards.yaml
index c932fa465..48bf1baf1 100644
--- a/package/crds/vertexai.gcp.upbound.io_tensorboards.yaml
+++ b/package/crds/vertexai.gcp.upbound.io_tensorboards.yaml
@@ -91,6 +91,7 @@ spec:
                     description: The labels with user-defined metadata to organize
                       your Tensorboards.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -137,6 +138,7 @@ spec:
                     description: The labels with user-defined metadata to organize
                       your Tensorboards.
                     type: object
+                    x-kubernetes-map-type: granular
                   project:
                     description: The ID of the project in which the resource belongs.
                       If it is not provided, the provider project is used.
@@ -344,6 +346,7 @@ spec:
                     description: The labels with user-defined metadata to organize
                       your Tensorboards.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: Name of the Tensorboard.
                     type: string
diff --git a/package/crds/workflows.gcp.upbound.io_workflows.yaml b/package/crds/workflows.gcp.upbound.io_workflows.yaml
index 5684854c7..3de9f1973 100644
--- a/package/crds/workflows.gcp.upbound.io_workflows.yaml
+++ b/package/crds/workflows.gcp.upbound.io_workflows.yaml
@@ -81,6 +81,7 @@ spec:
                     description: A set of key/value label pairs to assign to this
                       Workflow.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: Name of the Workflow.
                     type: string
@@ -213,6 +214,7 @@ spec:
                     description: A set of key/value label pairs to assign to this
                       Workflow.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: Name of the Workflow.
                     type: string
@@ -419,6 +421,7 @@ spec:
                     description: A set of key/value label pairs to assign to this
                       Workflow.
                     type: object
+                    x-kubernetes-map-type: granular
                   name:
                     description: Name of the Workflow.
                     type: string