Rust standalone VIP owner and dedicated election (draft)

[bb7133]

Scope

Draft Rust VIP owner for #149, based on the standalone SQL process from #290. The config projection selects exactly one backend cluster and uses that cluster's PD endpoints and TLS for a dedicated /tiproxy/vip/<ip>/owner election. The Rust owner runs only with --standalone; the Go process retains VIP authority in dual-process mode.

The owner removes a stale local address before readiness, waits for the SQL ready gate before campaigning, uses a 3-second session with a 1-second etcd request timeout, and binds the address after election. Keepalive continues during Linux add/delete commands and GARP bursts, which can exceed the lease TTL when commands are slow. It sends an initial GARP burst and bounded one-second refreshes. On controlled shutdown, an awaited pre-close removes the address and retires the owner before SQL drain. Main calls the barrier on all supervised termination paths.

The Linux adapter uses ip for exact-IP/prefix inspection and address changes, with noninteractive sudo ip fallback on permission errors. GARP uses direct arping or noninteractive sudo arping. This does not reproduce Go's raw-socket library GARP path and needs real Linux validation.

Checks

• make rust-lint (workspace): PASS
• make rust-test (workspace): PASS, including address parsing and pre-close acknowledgement/fallback tests
• make rust-build (workspace): PASS
• make lint: fails on pre-existing Go pkg/controlbridge/helpers_test.go unused recordingHandler declarations. This PR changes Rust, its Linux acceptance workflow, and its test script; it does not change Go source. go mod tidy left no changes.

Draft acceptance gate

No Linux host/network namespace is available in the local macOS workspace. The new Rust VIP Linux acceptance workflow runs two real standalone processes in separate namespaces against one PD/TiDB, capturing ip -j addr, election state, SQL results and timestamps for one holder, controlled close, restart, and whole-node/link loss. The first five runs, through 36213639260, failed SQL: the fixture's TiDB topology lacked a keyspace label, so standalone metering correctly rejected incomplete backend attribution after routing. The test now supplies a TiDB [labels] keyspace configuration and verifies that PD publishes it before starting Rust.

Head 78b0a941 Linux run 36214270719 passed: the initial owner b, controlled handoff to a, b restart while a retained ownership, and a node/link loss followed by takeover by b each had exactly one bound VIP and successful SQL through it. Address snapshots, election records, backend topology, SQL events and an empty overlap sampler are in the run artifact. Follow-up heads c7b983a8 and 0264bf4b passed SQL but did not prove GARP: the runner uses Thomas Habets ARPing 2.24 (-i for interface), and -U -i without -S VIP sends with the node IP as source. Head 5ad76d6b added -S VIP. Current exact head da5904d5 Linux run 36215836966 passed SQL, single-owner and per-owner GARP checks: the initial a MAC, controlled takeover b MAC, and whole-node/link-loss takeover a MAC each broadcast who-has VIP tell VIP. Address/election snapshots, MAC-bearing packet capture, SQL events, and an empty overlap sampler are in the artifact.

The workflow does not yet prove process-only SIGKILL safety. The owner currently adds an address without a finite lifetime, and SIGKILL bypasses its delete path; a surviving interface may therefore retain the old VIP when another node acquires the expired lease. Persistent local delete failure has the same split-brain risk. The per-owner, on-wire GARP gate is now passing; resolve these address-fencing failure cases before marking this PR ready.

[bb7133]

Migrated to pingcap#1389: pingcap#1389

This source PR is closed as part of the upstream migration; its historical timeline and checks remain here.