Defaults

When a workspace references a template via workspace.spec.templateRef, the template’s defaults fill in any attributes that workspace.spec did not specify.

A template optionally can add labels to the workspace.metadata.labels.

What gets defaulted

The general rule is that a template default applies only when the workspace.spec omits this particular attribute.

For example, if a workspace.spec specifies a containerSecurityContext, the template’s defaultContainerSecurityContext won’t be applied at all.

Template field	Workspace field it fills
defaultImage	spec.image
defaultResources	spec.resources
primaryStorage.defaultSize	spec.storage.size
primaryStorage.defaultMountPath	spec.storage.mountPath
primaryStorage.defaultStorageClassName	spec.storage.storageClassName
defaultContainerConfig	spec.containerConfig
defaultNodeSelector	spec.nodeSelector
defaultAffinity	spec.affinity
defaultTolerations	spec.tolerations
defaultOwnershipType	spec.ownershipType
defaultAccessType	spec.accessType
defaultAccessStrategy	spec.accessStrategy
defaultIdleShutdown	spec.idleShutdown
defaultLifecycle	spec.lifecycle
defaultReadinessProbe	spec.readinessProbe
defaultPodSecurityContext	spec.podSecurityContext
defaultContainerSecurityContext	spec.containerSecurityContext

Merge rules

The following template.spec attributes modify an attribute even when the workspace user specified a value for that attribute in the workspace.spec or workspace.metadata.

Template field	Workspace field it fills
baseEnv	spec.env
baseLabels	metadata.labels

For such attributes, the controller adds the template defaults to the user-specified workspace attributes.

In case of conflict between the template default and the value specified by the workspace, the workspace attribute takes precedence.

When defaults apply

The workspace mutating webhook injects defaults at workspace creation and update time.

When a template.spec changes, the controller does not modify running workspaces that already reference it — this is the lazy application model.