mozilla/bedrock

Move waffle switches into the admin

Closed this issue · 4 comments

stevejalim commented

Description

Now that we're using a centralised DB again, we can move our waffle-switch approach away from a separate repo (the waffle_configs directory in momeao/www-config and instead use the Django admin on the CMS deployment to manage them.

The admin on the CMS deployment is connected to the primary DB, and waffle config changes will be flowed down to the replicas for the web pods effectively immediately, which will be faster than the current process, which reads from www-config a most every five minutes.

Whether we go (back?) to https://waffle.readthedocs.io/en/stable/ or use something else, we'll need to decide on an approach and also migrate existing switches from www-config into the Bedrock primary DB for Dev, Stage and Prod (as these all appear to have waffle configs in www-config.

Success Criteria

  • Feature flipping via the Django admin is enabled
  • The latest state of www-config's waffle_configs dir is migrated into the DB
  • www-config is no longer read from as part of ./bin/run-db-update.sh
  • waffle_configs dir is removed from www-config
  • Documentation is updated accordingly
  • Users have appropriate access to the Django Admin in a way that doesn't clash with the Wagtail Admin
janbrasna commented

@stevejalim FYI I've been cleaning up the switches to only keep the ones in use for #14092 — so after mozmeao/www-config#582 this should be all — and only those used live will remain, not having to migrate junk.

stevejalim commented

I can't recall where we discussed access to the django-admin for the waffle controls, but here's what I suggest:

  • For each of the Websites team, we need to add them to all three peoplemo groups for CMS SSO access (because that's also the same SSO used for the Django admin:

    • bedrock_cms_production-access
    • bedrock_cms_staging-access
    • bedrock_cms_dev-access

  • In each Django admin, we add an auth.Group of Waffle access (or similar) with the permissions to add/edit/delete a Waffle Switch

  • We add User accounts for all members of the Websites team (who are not already in the admin)

    • Each user is marked as is_staff=True so they can log in to the Django admin (but not is_superuser=True because that will make them Wagtail Admins too, which we don't want to be too loose with)
    • Each user is added to the Waffle access group

  • We add a folder of bookmarks to the Team Slack channel with direct links to the Waffle-editing part of the Django admin for Dev, Stage and Prod

@robhudson Would you be up for taking this on as part of the overall epic?

robhudson commented

All success criteria is met except " waffle_configs dir is removed from www-config " but we can archive this repo now. It is no longer used.