vtctl is a command-line tool used to administer a Vitess cluster. It is available as both a standalone tool (vtctl) and client-server (vtctlclient in combination with vtctld). Using client-server is recommended, as it provides an additional layer of security when using the client remotely.
Using vtctl, you can identify primary and replica databases, create tables, initiate failovers, perform resharding operations, and so forth.
As vtctl performs operations, the Topology Service is updated as needed. Other Vitess servers observe those changes and react accordingly. For example, if you use vtctl to fail over to a new primary database, vtgate sees the change and directs future write operations to the new primary.