Stop defaulting within the template blocks

[EronWright]

The type of the StackSpec.workspaceTemplate field should be an "apply" variant, similar to k8s.io/client-go/applyconfigurations; it should not set any default values. Otherwise it makes for noise in the higher-level APIs and overstates their intentions.

For example, when we apply a given stack:

kind: Stack
spec:
  workspaceTemplate:
    spec:
      image: pulumi/pulumi:3.134.1-nonroot

We get:

kind: Stack
spec:
  workspaceTemplate:
    metadata: {}
    spec:
      image: pulumi/pulumi:3.134.1-nonroot
      resources: {}
      securityProfile: restricted
      serviceAccountName: default

[cleverguy25]

Added to epic #586

[blampe]

I think this is more to do with the WorkspaceSpec embedded in the Stack. We probably want an annotation to disable defaults on it (if there is such a thing) or create a separate Partial/Embedded type without defaults.

https://github.com/pulumi/pulumi-kubernetes-operator/blob/58b053960356ce484dee24a47f5aaed475ba9f7d/operator/config/crd/bases/pulumi.com_stacks.yaml#L9340-L9344

[EronWright]

@blampe there's a code generator for just this purpose (applyconfigurations), to generate an EmbeddedWorkspaceSpec.

The same issue is present with PodTemplate in the WorkspaceSpec. IIRC there was a problem with DeepCopy being missing on the generated code, need to revisit it.