Support Vitess v22/v23 tablet discovery via gRPC

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.16-alpine
+FROM golang:1.25-alpine
 
 COPY . /go/src/github.com/github/freno
 WORKDIR /go/src/github.com/github/freno
@@ -7,6 +7,8 @@ RUN go build -ldflags '-w -s' -o freno cmd/freno/main.go
 
 FROM alpine
 
+RUN apk add --no-cache ca-certificates
+
 COPY --from=0 /go/src/github.com/github/freno/freno /usr/local/bin/freno
 COPY conf/freno.conf.json /etc/freno.conf.json
 

Dockerfile.test

@@ -1,11 +1,6 @@
-FROM golang:1.16-stretch
+FROM golang:1.25-bookworm
 LABEL maintainer="github@github.com"
 
-# Update stretch repositories
-RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \
-           -e 's|security.debian.org|archive.debian.org/|g' \
-           -e '/stretch-updates/d' /etc/apt/sources.list
-
 RUN useradd -m testuser
 
 RUN apt-get update

README.md

@@ -78,6 +78,10 @@ See [sample config file](resources/freno.conf.sample.json). Also find:
 
 ### Deployment
 
+Building from source requires Go 1.25 or newer. Run `script/cibuild` to build and
+run the race-enabled unit tests. See [Vitess discovery](doc/mysql.md#vitess-discovery)
+for gRPC configuration and upgrade requirements.
+
 See [deployment docs](doc/deploy.md) for suggestions on a recommended `freno` deployment setup.
 
 ### Resources

build.sh

@@ -72,10 +72,7 @@ function precheck() {
     ok=1
   fi
 
-  if ! go version | egrep -q 'go(1\.1[6789])' ; then
-    echo "go version must be 1.16 or above"
-    ok=1
-  fi
+  . "$mydir/script/bootstrap"
 
   return $ok
 }
@@ -143,7 +140,7 @@ function build() {
   prefix="$4"
   ldflags="-X main.AppVersion=${RELEASE_VERSION} -X main.GitCommit=${GIT_COMMIT}"
   echo "Building via $(go version)"
-  gobuild="go build -i ${opt_race} -ldflags \"$ldflags\" -o $builddir/freno${prefix}/freno cmd/freno/main.go"
+  gobuild="go build ${opt_race} -ldflags \"$ldflags\" -o $builddir/freno${prefix}/freno cmd/freno/main.go"
 
   case $os in
     'linux')

doc/mysql.md

@@ -123,6 +123,82 @@ Noteworthy:
 - `local` cluster chooses to override `User`, `Password` and `IgnoreHostsCount`.
 - `local` cluster defines a static list of hosts.
 
+### Vitess discovery
+
+For Vitess v22 and v23, configure the native `Vtctld.GetTablets` gRPC service:
+
+```json
+"VitessSettings": {
+  "GRPCAddress": "vtctld.example.com:15999",
+  "GRPCCAFile": "/etc/freno/vitess-ca.pem",
+  "GRPCServerName": "vtctld.example.com",
+  "Keyspace": "commerce",
+  "Shard": "",
+  "Cells": ["zone1", "zone2"],
+  "TimeoutSecs": 5
+}
+```
+
+`GRPCAddress` is an explicit `host:port` for a vtctld listener exposing the
+`vtctlservice.Vtctld` service, not an HTTP URL or a vttablet endpoint. No port is
+inferred from `API`. When `GRPCAddress` is nonempty it takes precedence over
+`API`, including on failure: there is no HTTP fallback.
+
+TLS and certificate verification are enabled by default, using system CA roots
+and the address's hostname. `GRPCCAFile` optionally replaces the system roots
+with certificates from a PEM file. `GRPCServerName` optionally specifies the
+expected certificate DNS name, for example when connecting through a different
+address. Omit these two fields when system trust and the address's name suffice.
+There is no option to skip certificate verification. Servers requiring client
+certificates or authentication metadata need additional client support; these
+credentials are not configured by this discovery path.
+
+Only for an intentionally plaintext gRPC listener, set `"GRPCInsecure": true`.
+This disables transport encryption, not just certificate verification, and
+cannot be combined with `GRPCCAFile` or `GRPCServerName`. Do not use it as a
+workaround for TLS errors or to migrate an HTTPS configuration to plaintext.
+
+`Keyspace` is required. An empty or omitted `Shard` discovers all shards in that
+keyspace. `Cells` restricts discovery to those cells; empty entries are ignored.
+If `Cells` is omitted or empty, it inherits `Stores.MySQL.VitessCells`. If no
+nonempty cells remain, all cells are eligible. Only `REPLICA` tablets are used,
+and their `mysql_hostname` and `mysql_port` supply the probe addresses, not their
+vttablet hostname or service ports. The gRPC response has no realtime tablet
+health stats; Freno continues to collect its configured MySQL metrics and HTTP
+checks.
+
+`TimeoutSecs` bounds each discovery call, including connection establishment;
+zero or omitted means five seconds. Each gRPC call owns and closes its
+connection. Requests set `Strict=true` so a topology/cell failure is an error,
+not a successful partial inventory. Errors are logged and do not replace the
+previous inventory. Successful responses with no replicas remain an empty
+inventory, as with HTTP discovery.
+
+Existing `API`-only configurations retain the legacy HTTP discovery path and
+its realtime-stat filtering. That endpoint was
+[removed in Vitess v23.0.7](https://github.com/vitessio/vitess/releases/tag/v23.0.7#legacy-vtctld-http-api-removed);
+configure gRPC before upgrading to a version without it. The HTTP transport is
+not made compatible with its removal.
+
+The client uses the stable [Vitess v0.21.0 generated schema](https://github.com/vitessio/vitess/blob/v21.0.0/proto/vtctldata.proto) rather than
+upgrading to v23 libraries. Its request fields and response match
+the public [v22 GetTablets schema](https://github.com/vitessio/vitess/blob/v22.0.0/proto/vtctldata.proto)
+and [v23 GetTablets schema](https://github.com/vitessio/vitess/blob/v23.0.8/proto/vtctldata.proto);
+the request filters by replica type and results are also filtered locally.
+The v0.12.6 schema was also evaluated, but its
+[runtime helpers](https://github.com/vitessio/vitess/blob/v12.0.6/go/hack/runtime.go) do not link with
+the required modern Go toolchain. Local gRPC-server tests exercise the RPC
+contract, filtering, TLS and errors; they are not real v22/v23 vtctld daemon
+integration tests.
+
+Building requires Go 1.25 or newer. This is required by the patched gRPC
+transport, not by the older Vitess schema; see the upstream
+[HTTP/2 memory-exhaustion advisory](https://github.com/advisories/GHSA-vp52-pcj8-j9qc).
+Downstream builders must update their Go toolchain and build the new source
+revision. Runtime rollout also requires a reachable gRPC listener, authorization
+to call `GetTablets`, and the appropriate CA certificates. Installing a new
+binary alone does not change `API`-only configurations.
+
 
 ### Non lag metrics
 

go.mod

@@ -1,28 +1,34 @@
 module github.com/github/freno
 
-go 1.20
+go 1.25.0
 
 require (
 	github.com/DATA-DOG/go-sqlmock v1.5.0
-	github.com/armon/go-metrics v0.0.0-20190430140413-ec5e00d3c878
+	github.com/armon/go-metrics v0.4.1
 	github.com/boltdb/bolt v1.3.1
 	github.com/bradfitz/gomemcache v0.0.0-20190913173617-a41fca850d0b
-	github.com/go-sql-driver/mysql v1.6.0
+	github.com/go-sql-driver/mysql v1.7.1
 	github.com/hashicorp/go-msgpack v1.1.5
 	github.com/julienschmidt/httprouter v1.3.0
 	github.com/outbrain/golib v0.0.0-20180830062331-ab954725f502
 	github.com/patrickmn/go-cache v2.1.0+incompatible
-	github.com/rcrowley/go-metrics v0.0.0-20190826022208-cac0b30c2563
-	golang.org/x/sys v0.1.0 // indirect
-	vitess.io/vitess v2.1.1+incompatible
+	github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0
+	golang.org/x/sys v0.47.0 // indirect
+	google.golang.org/grpc v1.83.2
+	vitess.io/vitess v0.21.0
 )
 
-require github.com/stretchr/testify v1.3.0
+require github.com/stretchr/testify v1.9.0
 
 require (
-	github.com/davecgh/go-spew v1.1.0 // indirect
-	github.com/golang/protobuf v1.2.0 // indirect
-	github.com/hashicorp/go-immutable-radix v1.0.0 // indirect
-	github.com/hashicorp/golang-lru v0.5.0 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
+	github.com/hashicorp/golang-lru v1.0.2 // indirect
+	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	golang.org/x/net v0.58.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 )