VReplication: use db_filtered user for vstreams

[mattlord]

Description

When performing VReplication workflows — such as MoveTables — we need to stream table rows, query results, and binary log events from the source in order to copy data and changes to the target.

The com_binlog_dump_gtid command is used on the source side in order to stream the binary log events (vstreamer->binlog streamer) from the source tablet's mysqld to the vttablet for filtering before sending to the target vttablets (vcopier->vplayer). In order to execute this command the user needs the REPLICATION SLAVE privilege.

A big issue this PR addresses is that the db_app user was used for this. Not only is this unexpected (non-intuitive and not documented), but it requires that the application user has replication privileges which is not the norm. In this PR we:

1. Use the db_filtered user — which already has the REPLICATION SLAVE privilege — for streaming the binlog events (binlog streamer)
   • ℹ️ There are also SQL commands like SHOW BINARY LOGS executed in related connection/code that require the REPLICATION CLIENT privilege, which db_filtered already has
2. Use the db_filtered user for all other base vstream types: row streamer and results streamer
   • ℹ️ This also applies to more specialized vstreams such as used for messaging
   • 💡 This then aligns the product with the existing documentation: https://vitess.io/docs/11.0/reference/vreplication/faq/
3. We remove the REPLICATION SLAVE privilege from the default db_app user
   • ⚠️ A follow-up ticket is needed to update the embedded content in mysqlctl (done via make embed_config which itself was broken), including this change and the recent super_read_only change (see related issue below)

Related Issue(s)

• Follow-up work: Update the embedded config data in mysqlctl #10094

Checklist

• Should this PR be backported? NO
• Tests were are not required
• Documentation updates: Document usage of db_filtered for VReplication website#1011

[rohit-nayak-ps]

LGTM
nice catch

[mattlord]

LGTM
nice catch

I increased the scope a bit to use the vt_filtered user for all base vstreamers: row, results, binlog. I believe that:

1. This simplifies future work for VReplication as we lock down the MySQL accounts used (for vstreams at least, it's all db_filtered)
2. This simplifies operations as VReplication is using a single MySQL user account for vstreams
3. The product then aligns with the docs: https://vitess.io/docs/14.0/reference/vreplication/faq/

That's why I requested a re-review. Sorry. It was a long round about adventure to find out why the PITR recovery tests (which use rippled) were failing (dbconfig parts of bbdb16a).

[mattlord]

@derekperkins please let me know if you have any messaging related questions or concerns. Thanks!

[rohit-nayak-ps]

lgtm