. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Extending the Vindex API . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 VStream API and Resharding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 API & usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 VStream API and Resharding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 API & usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . origin git@github.com:/vitess.git (push) To help you keep your fork in sync with the main repo, add an upstream remote: $ git remote add upstream git@github.com:vitessio/vitess.git $ git

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Extending the Vindex API . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 VStream API and Resharding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 API & usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 API & usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . origin git@github.com:/vitess.git (push) To help you keep your fork in sync with the main repo, add an upstream remote: $ git remote add upstream git@github.com:vitessio/vitess.git $ git omit the upstream master from the git pull command when you let your master branch always track the main vitessio/vitess repository. To achieve this, run this command once: (master) $ git branch --set-upstream

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 API & usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . customer_lookup ( id int NOT NULL, keyspace_id varbinary(256), primary key(id) ); The customer table is the main table we want to shard using country. The lookup table will help us do that. Region Vindex We will goal of region-based sharding is data locality, it makes sense to co-locate the lookup data with the main customer data. We first define an identity vindex: "identity": { "type": "binary" } Then we create

origin git@github.com:/vitess.git (push) To help you keep your fork in sync with the main repo, add an upstream remote: $ git remote add upstream git@github.com:vitessio/vitess.git $ git omit the upstream master from the git pull command when you let your master branch always track the main vitessio/vitess repository. To achieve this, run this command once: (master) $ git branch --set-upstream want this. For example, if there are tables with one-to-many relationships, the Primary Vindex of the main table is likely to be the same as the Primary Key. However, if you want the rows of the secondary

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Vitess API Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 v3 API (alpha) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . origin git@github.com:/vitess.git (push) To help you keep your fork in sync with the main repo, add an upstream remote: $ git remote add upstream git@github.com:vitessio/vitess.git $ git

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 Vitess API Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 v3 API (alpha) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . origin git@github.com:/vitess.git (push) To help you keep your fork in sync with the main repo, add an upstream remote: $ git remote add upstream git@github.com:vitessio/vitess.git $ git

Vitess repository was considered in scope, however the main focus of the audit was VTAdmin which is located at https://github.com/vitessio/vitess/tree/main/go/vt/vtadmin. 4 Vitess Security Audit, 2023 Threat can. VTAdmin consists of two components: 1. A web interface - VTAdmin-web 2. A server - VTAdmin-api 5 Vitess Security Audit, 2023 The web interface connects to the server which in turn forwards the authentication plugin, VTAdmin-api adds it as a middleware at the http mux layer. VTAdmin-api does this in vitess/go/vt/vtadmin/api.go, when the routes are initialized: First VTAdmin-api checks if the user has

implementation. The auditors managed to reach wide-spanning coverage of all aspects pertinent to the main repository of the Vitess software system. The most likely avenues for exploitation were chosen and team gained about the Vitess scope system under scrutiny. Scope • Vitess ◦ The publicly available main repository at https://github.com/vitessio/vitess was used as the codebase to be verified. ▪ branch initial phase (Phase 1) mostly comprised manual source code reviews, in particular in terms of the API endpoints, input handlers and parsers. The review carried out during Phase 1 aimed at spotting insecure