Rust standalone VIP owner and dedicated election (draft)

[bb7133]

Recreated from bb7133/tiproxy#292. Original author: bb7133; created: 2026-09-26T01:17:56Z; source body SHA-256: e7bd4f6c341731dfbb2b20d793ce63b523052d151c0d547b85e2975de7fd9a83. Historical reviews/checks remain on the source PR.

Scope

Draft Rust VIP owner for #1317, based on the standalone SQL process from bb7133#290. The config projection selects exactly one backend cluster and uses that cluster's PD endpoints and TLS for a dedicated /tiproxy/vip/<ip>/owner election. The Rust owner runs only with --standalone; the Go process retains VIP authority in dual-process mode.

The owner removes a stale local address before readiness, waits for the SQL ready gate before campaigning, uses a 3-second session with a 1-second etcd request timeout, and binds the address after election. Keepalive continues during Linux add/delete commands and GARP bursts, which can exceed the lease TTL when commands are slow. It sends an initial GARP burst and bounded one-second refreshes. On controlled shutdown, an awaited pre-close removes the address and retires the owner before SQL drain. Main calls the barrier on all supervised termination paths.

The Linux adapter uses ip for exact-IP/prefix inspection and address changes, with noninteractive sudo ip fallback on permission errors. GARP uses direct arping or noninteractive sudo arping. This does not reproduce Go's raw-socket library GARP path and needs real Linux validation.

Checks

• make rust-lint (workspace): PASS
• make rust-test (workspace): PASS, including address parsing and pre-close acknowledgement/fallback tests
• make rust-build (workspace): PASS
• make lint: fails on pre-existing Go pkg/controlbridge/helpers_test.go unused recordingHandler declarations. This PR changes Rust, its Linux acceptance workflow, and its test script; it does not change Go source. go mod tidy left no changes.

Draft acceptance gate

No Linux host/network namespace is available in the local macOS workspace. The new Rust VIP Linux acceptance workflow runs two real standalone processes in separate namespaces against one PD/TiDB, capturing ip -j addr, election state, SQL results and timestamps for one holder, controlled close, restart, and whole-node/link loss. The first five runs, through 36213639260, failed SQL: the fixture's TiDB topology lacked a keyspace label, so standalone metering correctly rejected incomplete backend attribution after routing. The test now supplies a TiDB [labels] keyspace configuration and verifies that PD publishes it before starting Rust.

Head 78b0a941 Linux run 36214270719 passed: the initial owner b, controlled handoff to a, b restart while a retained ownership, and a node/link loss followed by takeover by b each had exactly one bound VIP and successful SQL through it. Address snapshots, election records, backend topology, SQL events and an empty overlap sampler are in the run artifact. Follow-up heads c7b983a8 and 0264bf4b passed SQL but did not prove GARP: the runner uses Thomas Habets ARPing 2.24 (-i for interface), and -U -i without -S VIP sends with the node IP as source. Head 5ad76d6b added -S VIP. Current exact head da5904d5 Linux run 36215836966 passed SQL, single-owner and per-owner GARP checks: the initial a MAC, controlled takeover b MAC, and whole-node/link-loss takeover a MAC each broadcast who-has VIP tell VIP. Address/election snapshots, MAC-bearing packet capture, SQL events, and an empty overlap sampler are in the artifact.

The workflow does not yet prove process-only SIGKILL safety. The owner currently adds an address without a finite lifetime, and SIGKILL bypasses its delete path; a surviving interface may therefore retain the old VIP when another node acquires the expired lease. Persistent local delete failure has the same split-brain risk. The per-owner, on-wire GARP gate is now passing; resolve these address-fencing failure cases before marking this PR ready.

[ti-chi-bot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign yangkeao for approval. For more information see the Code Review Process.
Please ensure that each of them provides their approval before proceeding.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pingcap-cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

CodexM5 seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}