private void ensureRoleNamesAnno(User user) {
        roleService.getRolesByUsername(user.getMetadata().getName())
            .collectList()
            .map(JsonUtils::objectToJson)
            .doOnNext(roleNamesJson -> {
                var annotations = Optional.ofNullable(user.getMetadata().getAnnotations())
                    .orElseGet(HashMap::new);
                user.getMetadata().setAnnotations(annotations);
                annotations.put(User.ROLE_NAMES_ANNO, roleNamesJson);
            })
            .block(Duration.ofMinutes(1));
    }
@Test
    void ensureRoleNamesAnno() {
        when(roleService.getRolesByUsername("fake-user")).thenReturn(Flux.just("fake-role"));
        when(client.fetch(eq(User.class), eq("fake-user")))
            .thenReturn(Optional.of(user("fake-user")));
        when(externalUrlSupplier.get()).thenReturn(URI.create("/"));

        userReconciler.reconcile(new Reconciler.Request("fake-user"));

        verify(client).update(assertArg(user -> {
            assertEquals("""
                    ["fake-role"]\
                    """,
                user.getMetadata().getAnnotations().get(User.ROLE_NAMES_ANNO));
        }));
    }