func (r *TokenReconciler) Reconcile(request ctrl.Request) (ctrl.Result, error) {
	ctx := context.Background()
	logt := r.Log.WithValues("token", request.NamespacedName)
	logt.Info("reconciling IBM cloud IAM tokens", "secretRef", request.Name)
	secret := &corev1.Secret{}
	err := r.Get(ctx, request.NamespacedName, secret)
	if err != nil {
		if errors.IsNotFound(err) {
			logt.Info("object not found")
			return ctrl.Result{}, nil
		}
		logt.Info("object cannot be read", "error", err)
		return ctrl.Result{}, err
	}
	if secret.DeletionTimestamp != nil {
		return ctrl.Result{}, nil
	}
	apikeyb, ok := secret.Data["api-key"]
	if !ok {
		logt.Info("missing api-key key in secret", "Namespace", secret.Namespace, "Name", secret.Name)
		return ctrl.Result{}, nil
	}
	regionb, ok := secret.Data["region"]
	if !ok {
		logt.Info("set default region to us-south")
		regionb = []byte("us-south")
	}
	region := string(regionb)
	logt.Info("authenticating...")
	creds, err := r.Authenticate(string(apikeyb), string(regionb))
	if _, ok := err.(auth.InvalidConfigError); ok {
		logt.Error(err, "failed to create auth client", "region", region)
		return ctrl.Result{}, nil
	}
	if err != nil {
		logt.Error(err, "authentication failed")
		return ctrl.Result{}, err  
	}
	tokensRef := strings.TrimSuffix(secret.Name, icoSecretName) + icoTokensName  
	logt.Info("creating tokens secret", "name", tokensRef)
	tokens := &corev1.Secret{
		ObjectMeta: metav1.ObjectMeta{
			Name:      tokensRef,
			Namespace: secret.Namespace,
		},
		Data: creds.MarshalSecret(),
	}
	err = r.Delete(ctx, tokens)
	if err != nil && !errors.IsNotFound(err) {
		return ctrl.Result{}, err
	}
	if err := r.Create(ctx, tokens); err != nil {
		logt.Error(err, "failed to update secret (retrying)")
		return ctrl.Result{}, err
	}
	logt.Info("secret created", "name", tokensRef)
	return ctrl.Result{RequeueAfter: 10 * time.Minute}, nil
}
Reconcile computes IAM and UAA tokens
package controllers
import (
	"context"
	"strings"
	"time"
	"github.com/go-logr/logr"
	"github.com/ibm/cloud-operators/internal/ibmcloud/auth"
	corev1 "k8s.io/api/core/v1"
	"k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/runtime"
	ctrl "sigs.k8s.io/controller-runtime"
	"sigs.k8s.io/controller-runtime/pkg/client"
	"sigs.k8s.io/controller-runtime/pkg/controller"
	"sigs.k8s.io/controller-runtime/pkg/event"
	"sigs.k8s.io/controller-runtime/pkg/predicate"
)
const (
	icoSecretName = "ibmcloud-operator-secret"
	icoTokensName = "ibmcloud-operator-tokens"
)
type TokenReconciler struct {
	client.Client
	Log          logr.Logger
	Scheme       *runtime.Scheme
	Authenticate auth.Authenticator
}