docs: add demo for workload secrets

[davidweisse]

This adds a demo application running a MySQL server with an encrypted volume mount, similar to the volume-tester. For this, the cryptsetup init container uses the workload secret to set up a LUKS partition that is mounted to /var/lib/mysql. The demo is also provided as a release artifact as mysql-demo.yml.

[github-actions]

PR Preview Action v1.4.8
Preview removed because the pull request was closed.
2024-12-17 10:41 UTC

[burgerdev]

Great!

[burgerdev]

Overall LGTM, but we need to deal with the password before merging.

[m1ghtym0]

Awesome!
I like the idea of having more examples like this in the mid-term future.
One thought: Should we label them so that they are easier to "find" or people know immediately what they are looking at?

• Instead of "Confidential emoji voting" -> "Simple demo app"
• Instead of "Encrypted volume mount" -> "MySQL"

We then might want to have a dedicated "Tasks" section in the docs that goes more in-depth with certain operations such as "Mount encrypted volumes, "recover the coordinator", ...
We have these things hidden in the architecture and components section to some extend.

Let me know what you think:-)

[burgerdev]

We could also consider the https://diataxis.fr/ approach for structuring. I'd defer this discussion for the PR here, though.

[burgerdev]

lgtm, only few nits