command/meta: add -shadow flag to disable shadow graph

Since it is still very much possible for this to cause problems, this
can be used to disable the shadow graph. We'll purposely not document
this since the goal is to remove this flag as we become more confident
with it.

command/meta.go

@@ -63,10 +63,13 @@ type Meta struct {
 	//
 	// parallelism is used to control the number of concurrent operations
 	// allowed when walking the graph
+	//
+	// shadow is used to enable/disable the shadow graph
 	statePath    string
 	stateOutPath string
 	backupPath   string
 	parallelism  int
+	shadow       bool
 }
 
 // initStatePaths is used to initialize the default values for
@@ -312,6 +315,7 @@ func (m *Meta) contextOpts() *terraform.ContextOpts {
 	opts.Variables = vs
 	opts.Targets = m.targets
 	opts.UIInput = m.UIInput()
+	opts.Shadow = m.shadow
 
 	return &opts
 }
@@ -328,6 +332,9 @@ func (m *Meta) flagSet(n string) *flag.FlagSet {
 		f.Var((*FlagKVFile)(&m.autoVariables), m.autoKey, "variable file")
 	}
 
+	// Advanced (don't need documentation, or unlikely to be set)
+	f.BoolVar(&m.shadow, "shadow", true, "shadow graph")
+
 	// Experimental features
 	f.BoolVar(&terraform.X_newApply, "Xnew-apply", false, "experiment: new apply")
 

terraform/context.go

@@ -70,6 +70,7 @@ type ContextOpts struct {
 	StateFutureAllowed bool
 	Providers          map[string]ResourceProviderFactory
 	Provisioners       map[string]ResourceProvisionerFactory
+	Shadow             bool
 	Targets            []string
 	Variables          map[string]interface{}
 
@@ -93,6 +94,7 @@ type Context struct {
 	hooks      []Hook
 	module     *module.Tree
 	sh         *stopHook
+	shadow     bool
 	state      *State
 	stateLock  sync.RWMutex
 	targets    []string
@@ -174,6 +176,7 @@ func NewContext(opts *ContextOpts) (*Context, error) {
 		diff:      opts.Diff,
 		hooks:     hooks,
 		module:    opts.Module,
+		shadow:    opts.Shadow,
 		state:     state,
 		targets:   opts.Targets,
 		uiInput:   opts.UIInput,
@@ -695,13 +698,18 @@ func (c *Context) walk(
 	// If we have a shadow graph, walk that as well
 	var shadowCtx *Context
 	var shadowCloser Shadow
-	if shadow != nil {
+	if c.shadow && shadow != nil {
 		// Build the shadow context. In the process, override the real context
 		// with the one that is wrapped so that the shadow context can verify
 		// the results of the real.
 		realCtx, shadowCtx, shadowCloser = newShadowContext(c)
 	}
 
+	// Just log this so we can see it in a debug log
+	if !c.shadow {
+		log.Printf("[WARN] terraform: shadow graph disabled")
+	}
+
 	// Build the real graph walker
 	log.Printf("[DEBUG] Starting graph walk: %s", operation.String())
 	walker := &ContextGraphWalker{Context: realCtx, Operation: operation}

terraform/context_test.go

@@ -68,6 +68,9 @@ func TestNewContextState(t *testing.T) {
 }
 
 func testContext2(t *testing.T, opts *ContextOpts) *Context {
+	// Enable the shadow graph
+	opts.Shadow = true
+
 	ctx, err := NewContext(opts)
 	if err != nil {
 		t.Fatalf("err: %s", err)