Add tmp mount so that server can run locked down (#105)

This pr adds a tmp mount to the spire server pod so that it can run with
read only root.

Signed-off-by: Kevin Fox <[email protected]>

charts/spire/charts/spire-server/templates/statefulset.yaml

@@ -132,6 +132,9 @@ spec:
               mountPath: /controller-manager-config.yaml
               subPath: controller-manager-config.yaml
               readOnly: true
+            - name: spire-controller-manager-tmp
+              mountPath: /tmp
+              readOnly: false
         {{- end }}
         {{- if gt (len .Values.extraContainers) 0 }}
         {{- toYaml .Values.extraContainers | nindent 8 }}
@@ -158,6 +161,8 @@ spec:
             name: {{ include "spire-server.fullname" . }}
         - name: spire-server-socket
           emptyDir: {}
+        - name: spire-controller-manager-tmp
+          emptyDir: {}
         {{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }}
         - name: upstream-ca
           secret: