✨ Protect APIBindings created during workspace initialization

[palnabarun]

Summary

The APIBindings created during workspace initialization should not be updated or deleted by users as no controller reconciles those. Once they are updated or deleted, no lifecycle happens for those APIBindings.

This creates inconsistencies in the system as there is no guarantee that APIBindings listed in WorkspaceType.spec.defaultAPIBindings would be honored across the lifecycle of the workspace.

Release Notes

✨ Protect APIBindings created during Workspace Initialization 

[kcp-ci-bot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[kcp-ci-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign sttts for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[embik]

I feel like this is missing something, or is there magic around internal.kcp.io/* annotations that I am not aware of?

[kcp-ci-bot]

Issues go stale after 90d of inactivity.
After a furter 30 days, they will turn rotten.
Mark the issue as fresh with /remove-lifecycle stale.

If this issue is safe to close now please do so with /close.

/lifecycle stale