Feature Request: VStream and VReplication should use different MySQL users

[twthorn]

Feature Description

Both VStream and VReplication use the same user vt_filtered. If a Vitess/MySQL deployment has max_user_connections enabled, then it is possible that if VStream client is misbehaving (e.g., creates too many MySQL connections), then VReplication can be blocked entirely. Since VStream is more auxiliary for downstream use cases, it should not be tightly coupled with VReplication (which is essential to Vitess availability) via the shared resource (i.e., the connection pool for vt_filtered user).

Request here is to by default use a separate user. Or at least give the option to override the vstream or vreplication username.

Use Case(s)

Prevent vstream clients from stopping replication of tablets.

[mattlord]

@twthorn for the vtgate VStream API, it is VReplication on the tablet side (just no workflow). It's a fair point though. It's certainly possible to distinguish them from the caller side. I think the same basic problem would still hold though if we used another of the available users:

❯ vttablet --help | grep db | grep user
      --db_allprivs_user string                                          db allprivs user userKey (default "vt_allprivs")
      --db_app_user string                                               db app user userKey (default "vt_app")
      --db_appdebug_user string                                          db appdebug user userKey (default "vt_appdebug")
      --db_dba_user string                                               db dba user userKey (default "vt_dba")
      --db_erepl_user string                                             db erepl user userKey (default "vt_erepl")
      --db_filtered_user string                                          db filtered user userKey (default "vt_filtered")
      --db_repl_user string                                              db repl user userKey (default "vt_repl")

App would certainly be even more potentially problematic. But we could e.g. use the erepl (External Replication) user. That's not used at all anymore within Vitess itself, and VTGate VStreams could logically be considered external replication. What do you think?