Mount path /tmp as emptyDir volume

[ggogel]

Checklist

• I've searched the issue queue to verify this is not a duplicate feature request.
• I've pasted the output of kargo version, if applicable.
• I've pasted logs, if applicable.

Proposed Feature

The path /tmp is used in the promotion step git clone to save the cloned git repository. Currently, this path is part of the container's root filesystem. I'm proposing to mount an ephemeral emptyDir volume to this path.

Motivation

We are about to roll out Kargo to our production stage. One of the compliance requirements is to enable the securityContext readOnlyRootFilesystem. This protects the root filesystem of the container from being changed during runtime and therefore increases security. When we enable this, the promotion step git clone fails with the following error:

Suggested Implementation

I see two possible implementation options in the Kargo Helm Chart:

1. Allow to mount volumes to any of the containers. Currently, it is only possible to mount volumes to the dex container.
2. Mount an emptyDir volume in the path /tmp to the container by default.

[krancour]

I've been thinking about this for a while as well, albeit for different reasons.

emptyDir seems safe and easy.

Mounting any other sort of volume introduces security implications that I'd rather not grapple with at this point in time.

[SD-13]

@krancour @ggogel, this issue looks doable. Can I work on this?

[krancour]

@SD-13 it's yours.

[RohanMishra315]

Hey @SD-13 you workin' on this, if not could i take it ?

[SD-13]

@RohanMishra315 , I am working on it. Please pick some other issues

[ggogel]

I already implemented the change but went on a holiday break. Today I had time to test it in our environment and it works. I created the PR #3218.

@SD-13 I know that you already claimed this issue but three weeks have passed and we need this feature.

[SD-13]

@ggogel, No problem!