Support admin/CMS access for demo servers

[stevejalim]

We need to get SSO set up on the demo servers so that they can have content edited if need be, and Waffle switches tweaked via the Django Admin

Tasks

Beta Give feedback

1. Add a manage.py bootstrap_demo_server_admins command to mozilla/bedrock -> Add management command to bootstrap admin users on demo servers #15376
2. Request update to IAM / SSO to bring demos into scope -> https://mozilla-hub.atlassian.net/browse/IAM-1466
3. Set users as a k8s Secret DEMO_SERVER_ADMIN_USERS
4. Set SSO credentials as Secrets
5. Update Cloud Build trigger: expose new Secrets as an env vars
6. Update Cloud Build trigger: Call the new management command

[stevejalim]

I've been hacking on this a bit and I think the original plan (update the Cloud Build trigger to run the management command before deploying to Cloud Run) isn't the way forward, mainly because doing a multi-stage build (i.e. Bedrock build, then run the management command to boostrap data and then commit that into a new image) isn't proving clean or straightforward to do in Cloud Build. It's also slower even though it'su not even 100% working yet.

So, instead, I'm wondering about updating our ./bin/sync-all.sh script (which gets called during the Docker image build) to check for the presence of the DEMO_SERVER_ADMIN_USERS env var (which we can inject into the container at build) and to then run ./manage.py boostrap_demo_server_admins

I'm not a massive fan of this, as it adds demo-specific complexity to the general Dockerfile, but it's a lot cleaner from the Cloud Build / Cloud Run side.

No rush to reply, but what do you think @robhudson @pmac?

[robhudson]

I think that's fine. We could always revisit it later to re-evaluate. But for now it gets the job done and it's not a major blocker.