diff --git a/apis/securesourcemanager/v1alpha1/instance_types.go b/apis/securesourcemanager/v1alpha1/instance_types.go
index b96d13541c..125dc54679 100644
--- a/apis/securesourcemanager/v1alpha1/instance_types.go
+++ b/apis/securesourcemanager/v1alpha1/instance_types.go
@@ -88,6 +88,24 @@ type SecureSourceManagerInstanceObservedState struct {
 	HostConfig *Instance_HostConfig `json:"hostConfig,omitempty"`
 }
 
+// +kcc:proto=google.cloud.securesourcemanager.v1.Instance.PrivateConfig
+type Instance_PrivateConfig struct {
+	// Required. Immutable. Indicate if it's private instance.
+	IsPrivate *bool `json:"isPrivate,omitempty"`
+
+	// Required. Immutable. CA pool resource, resource must in the format of
+	//  `projects/{project}/locations/{location}/caPools/{ca_pool}`.
+	CaPoolRef *refs.PrivateCACAPoolRef `json:"caPoolRef,omitempty"`
+
+	// Output only. Service Attachment for HTTP, resource is in the format of
+	//  `projects/{project}/regions/{region}/serviceAttachments/{service_attachment}`.
+	HTTPServiceAttachment *string `json:"httpServiceAttachment,omitempty"`
+
+	// Output only. Service Attachment for SSH, resource is in the format of
+	//  `projects/{project}/regions/{region}/serviceAttachments/{service_attachment}`.
+	SSHServiceAttachment *string `json:"sshServiceAttachment,omitempty"`
+}
+
 // +genclient
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 // +kubebuilder:resource:categories=gcp,shortName=gcpsecuresourcemanagerinstance;gcpsecuresourcemanagerinstances
diff --git a/apis/securesourcemanager/v1alpha1/types.generated.go b/apis/securesourcemanager/v1alpha1/types.generated.go
index 1547d1c922..fc7eeda57e 100644
--- a/apis/securesourcemanager/v1alpha1/types.generated.go
+++ b/apis/securesourcemanager/v1alpha1/types.generated.go
@@ -14,10 +14,6 @@
 
 package v1alpha1
 
-import (
-	refs "github.com/GoogleCloudPlatform/k8s-config-connector/apis/refs/v1beta1"
-)
-
 // +kcc:proto=google.cloud.securesourcemanager.v1.Instance.HostConfig
 type Instance_HostConfig struct {
 	// Output only. HTML hostname.
@@ -34,24 +30,6 @@ type Instance_HostConfig struct {
 	GitSSH *string `json:"gitSSH,omitempty"`
 }
 
-// +kcc:proto=google.cloud.securesourcemanager.v1.Instance.PrivateConfig
-type Instance_PrivateConfig struct {
-	// Required. Immutable. Indicate if it's private instance.
-	IsPrivate *bool `json:"isPrivate,omitempty"`
-
-	// Required. Immutable. CA pool resource, resource must in the format of
-	//  `projects/{project}/locations/{location}/caPools/{ca_pool}`.
-	CaPoolRef *refs.PrivateCACAPoolRef `json:"caPoolRef,omitempty"`
-
-	// Output only. Service Attachment for HTTP, resource is in the format of
-	//  `projects/{project}/regions/{region}/serviceAttachments/{service_attachment}`.
-	HTTPServiceAttachment *string `json:"httpServiceAttachment,omitempty"`
-
-	// Output only. Service Attachment for SSH, resource is in the format of
-	//  `projects/{project}/regions/{region}/serviceAttachments/{service_attachment}`.
-	SSHServiceAttachment *string `json:"sshServiceAttachment,omitempty"`
-}
-
 // +kcc:proto=google.cloud.securesourcemanager.v1.Repository
 type Repository struct {
 	// Optional. A unique identifier for a repository. The name should be of the
diff --git a/pkg/controller/direct/securesourcemanager/mapper.generated.go b/pkg/controller/direct/securesourcemanager/mapper.generated.go
index 127af8b820..ec4e60aecc 100644
--- a/pkg/controller/direct/securesourcemanager/mapper.generated.go
+++ b/pkg/controller/direct/securesourcemanager/mapper.generated.go
@@ -43,32 +43,6 @@ func Instance_HostConfig_ToProto(mapCtx *direct.MapContext, in *krm.Instance_Hos
 	out.GitSsh = direct.ValueOf(in.GitSSH)
 	return out
 }
-func Instance_PrivateConfig_FromProto(mapCtx *direct.MapContext, in *pb.Instance_PrivateConfig) *krm.Instance_PrivateConfig {
-	if in == nil {
-		return nil
-	}
-	out := &krm.Instance_PrivateConfig{}
-	out.IsPrivate = direct.LazyPtr(in.GetIsPrivate())
-	if in.GetCaPool() != "" {
-		out.CaPoolRef = &refs.PrivateCACAPoolRef{External: in.GetCaPool()}
-	}
-	out.HTTPServiceAttachment = direct.LazyPtr(in.GetHttpServiceAttachment())
-	out.SSHServiceAttachment = direct.LazyPtr(in.GetSshServiceAttachment())
-	return out
-}
-func Instance_PrivateConfig_ToProto(mapCtx *direct.MapContext, in *krm.Instance_PrivateConfig) *pb.Instance_PrivateConfig {
-	if in == nil {
-		return nil
-	}
-	out := &pb.Instance_PrivateConfig{}
-	out.IsPrivate = direct.ValueOf(in.IsPrivate)
-	if in.CaPoolRef != nil {
-		out.CaPool = in.CaPoolRef.External
-	}
-	out.HttpServiceAttachment = direct.ValueOf(in.HTTPServiceAttachment)
-	out.SshServiceAttachment = direct.ValueOf(in.SSHServiceAttachment)
-	return out
-}
 func Repository_InitialConfig_FromProto(mapCtx *direct.MapContext, in *pb.Repository_InitialConfig) *krm.Repository_InitialConfig {
 	if in == nil {
 		return nil
diff --git a/pkg/controller/direct/securesourcemanager/mapper.go b/pkg/controller/direct/securesourcemanager/mapper.go
index 0e3e93381f..1f2bc171ea 100644
--- a/pkg/controller/direct/securesourcemanager/mapper.go
+++ b/pkg/controller/direct/securesourcemanager/mapper.go
@@ -16,6 +16,7 @@ package securesourcemanager
 
 import (
 	pb "cloud.google.com/go/securesourcemanager/apiv1/securesourcemanagerpb"
+	refs "github.com/GoogleCloudPlatform/k8s-config-connector/apis/refs/v1beta1"
 	krm "github.com/GoogleCloudPlatform/k8s-config-connector/apis/securesourcemanager/v1alpha1"
 
 	"github.com/GoogleCloudPlatform/k8s-config-connector/pkg/controller/direct"
@@ -61,7 +62,32 @@ func OperationMetadata_EndTime_ToProto(mapCtx *direct.MapContext, in *string) *t
 	mapCtx.Errorf("OperationMetadata_EndTime_ToProto not implemented")
 	return nil
 }
-
+func Instance_PrivateConfig_FromProto(mapCtx *direct.MapContext, in *pb.Instance_PrivateConfig) *krm.Instance_PrivateConfig {
+	if in == nil {
+		return nil
+	}
+	out := &krm.Instance_PrivateConfig{}
+	out.IsPrivate = direct.LazyPtr(in.GetIsPrivate())
+	if in.GetCaPool() != "" {
+		out.CaPoolRef = &refs.PrivateCACAPoolRef{External: in.GetCaPool()}
+	}
+	out.HTTPServiceAttachment = direct.LazyPtr(in.GetHttpServiceAttachment())
+	out.SSHServiceAttachment = direct.LazyPtr(in.GetSshServiceAttachment())
+	return out
+}
+func Instance_PrivateConfig_ToProto(mapCtx *direct.MapContext, in *krm.Instance_PrivateConfig) *pb.Instance_PrivateConfig {
+	if in == nil {
+		return nil
+	}
+	out := &pb.Instance_PrivateConfig{}
+	out.IsPrivate = direct.ValueOf(in.IsPrivate)
+	if in.CaPoolRef != nil {
+		out.CaPool = in.CaPoolRef.External
+	}
+	out.HttpServiceAttachment = direct.ValueOf(in.HTTPServiceAttachment)
+	out.SshServiceAttachment = direct.ValueOf(in.SSHServiceAttachment)
+	return out
+}
 func SecureSourceManagerRepositoryObservedState_FromProto(mapCtx *direct.MapContext, in *pb.Repository) *krm.SecureSourceManagerRepositoryObservedState {
 	if in == nil {
 		return nil