fix: do not delete workspace pod on authz errors

operator/internal/controller/auto/workspace_controller.go

@@ -242,6 +242,20 @@ func (r *WorkspaceReconciler) Reconcile(ctx context.Context, req ctrl.Request) (
 	initializedV, ok := pod.Annotations[PodAnnotationInitialized]
 	initialized, _ := strconv.ParseBool(initializedV)
 	if !ok || !initialized {
+		l.Info("Running whoami to ensure authentication is setup correctly with the workspace pod")
+		_, err = wc.WhoAmI(ctx, &agentpb.WhoAmIRequest{})
+		if err != nil {
+			l.Error(err, "unable to authenticate; retaining the workspace pod to retry later")
+			ready.Status = metav1.ConditionFalse
+			ready.Reason = "AuthenticationFailed"
+			ready.Message = "Unable to authenticate with the workspace pod."
+			if statusErr := updateStatus(); statusErr != nil {
+				return ctrl.Result{}, statusErr
+			}
+
+			return ctrl.Result{}, err
+		}
+
 		l.Info("Running pulumi install")
 		ready.Status = metav1.ConditionFalse
 		ready.Reason = "Installing"