Add optional check to restrict charts to target namespace

This change adds a new `RestrictToNamespace` option to gRPC calls.
When enabled, this will reject charts that attempt to install
resources outside the target namespace (either in another namespace,
or "global" non-namespaced resources).

This is intended as a simple namespace-scoped stop-gap permission
model, until helm/tiller becomes more RBAC-aware.  It implements a
simple binary mechanism that allows either "namespace local" or
"admin-installed global" operations, and trusts the client to indicate
which operation was intended.  It would be reasonable to think of this
as "the sudo approach".

Note:
- This change does not (yet) expose this option through to the `helm`
  CLI tool.
- This change does not (yet) modify rudder.  Rudder continues to allow
  any namespace in chart resources.

_proto/hapi/services/tiller.proto

@@ -209,6 +209,8 @@ message UpdateReleaseRequest {
 	bool reuse_values = 10;
 	// Force resource update through delete/recreate if needed.
 	bool force = 11;
+	// RestrictToNamespace, if true, will reject a chart that tries to create non-namespaced resources or resources in a namespace other than `namespace`
+	bool restrict_to_namespace = 12;
 }
 
 // UpdateReleaseResponse is the response to an update request.
@@ -234,6 +236,8 @@ message RollbackReleaseRequest {
 	bool wait = 7;
 	// Force resource update through delete/recreate if needed.
 	bool force = 8;
+	// RestrictToNamespace, if true, will reject a chart that tries to create non-namespaced resources or resources in a namespace other than `namespace`
+	bool restrict_to_namespace = 12;
 }
 
 // RollbackReleaseResponse is the response to an update request.
@@ -271,6 +275,8 @@ message InstallReleaseRequest {
 	// wait, if true, will wait until all Pods, PVCs, and Services are in a ready state
 	// before marking the release as successful. It will wait for as long as timeout
 	bool wait = 9;
+	// RestrictToNamespace, if true, will reject a chart that tries to create non-namespaced resources or resources in a namespace other than `namespace`
+	bool restrict_to_namespace = 10;
 }
 
 // InstallReleaseResponse is the response from a release installation.
@@ -288,6 +294,8 @@ message UninstallReleaseRequest {
 	bool purge = 3;
 	// timeout specifies the max amount of time any kubernetes client command can run.
 	int64 timeout = 4;
+	// RestrictToNamespace, if true, will reject a chart that tries to create non-namespaced resources or resources in a namespace other than `namespace`
+	bool restrict_to_namespace = 12;
 }
 
 // UninstallReleaseResponse represents a successful response to an uninstall request.

cmd/rudder/rudder.go

@@ -91,7 +91,7 @@ func (r *ReleaseModuleServiceServer) Version(ctx context.Context, in *rudderAPI.
 func (r *ReleaseModuleServiceServer) InstallRelease(ctx context.Context, in *rudderAPI.InstallReleaseRequest) (*rudderAPI.InstallReleaseResponse, error) {
 	grpclog.Print("install")
 	b := bytes.NewBufferString(in.Release.Manifest)
-	err := kubeClient.Create(in.Release.Namespace, b, 500, false)
+	err := kubeClient.Create(in.Release.Namespace, b, 500, false, false)
 	if err != nil {
 		grpclog.Printf("error when creating release: %v", err)
 	}
@@ -109,7 +109,7 @@ func (r *ReleaseModuleServiceServer) DeleteRelease(ctx context.Context, in *rudd
 		return resp, fmt.Errorf("Could not get apiVersions from Kubernetes: %v", err)
 	}
 
-	kept, errs := tiller.DeleteRelease(rel, vs, kubeClient)
+	kept, errs := tiller.DeleteRelease(rel, vs, kubeClient, false)
 	rel.Manifest = kept
 
 	allErrors := ""
@@ -131,7 +131,7 @@ func (r *ReleaseModuleServiceServer) RollbackRelease(ctx context.Context, in *ru
 	grpclog.Print("rollback")
 	c := bytes.NewBufferString(in.Current.Manifest)
 	t := bytes.NewBufferString(in.Target.Manifest)
-	err := kubeClient.Update(in.Target.Namespace, c, t, in.Force, in.Recreate, in.Timeout, in.Wait)
+	err := kubeClient.Update(in.Target.Namespace, c, t, in.Force, in.Recreate, in.Timeout, in.Wait, false)
 	return &rudderAPI.RollbackReleaseResponse{}, err
 }
 
@@ -140,7 +140,7 @@ func (r *ReleaseModuleServiceServer) UpgradeRelease(ctx context.Context, in *rud
 	grpclog.Print("upgrade")
 	c := bytes.NewBufferString(in.Current.Manifest)
 	t := bytes.NewBufferString(in.Target.Manifest)
-	err := kubeClient.Update(in.Target.Namespace, c, t, in.Force, in.Recreate, in.Timeout, in.Wait)
+	err := kubeClient.Update(in.Target.Namespace, c, t, in.Force, in.Recreate, in.Timeout, in.Wait, false)
 	// upgrade response object should be changed to include status
 	return &rudderAPI.UpgradeReleaseResponse{}, err
 }
@@ -149,7 +149,7 @@ func (r *ReleaseModuleServiceServer) UpgradeRelease(ctx context.Context, in *rud
 func (r *ReleaseModuleServiceServer) ReleaseStatus(ctx context.Context, in *rudderAPI.ReleaseStatusRequest) (*rudderAPI.ReleaseStatusResponse, error) {
 	grpclog.Print("status")
 
-	resp, err := kubeClient.Get(in.Release.Namespace, bytes.NewBufferString(in.Release.Manifest))
+	resp, err := kubeClient.Get(in.Release.Namespace, false, bytes.NewBufferString(in.Release.Manifest))
 	in.Release.Info.Status.Resources = resp
 	return &rudderAPI.ReleaseStatusResponse{
 		Release: in.Release,

pkg/helm/option.go

@@ -370,6 +370,34 @@ func UpgradeForce(force bool) UpdateOption {
 	}
 }
 
+// InstallRestrictToNamespace rejects charts that try to create resources outside their namespace
+func InstallRestrictToNamespace(restrict bool) InstallOption {
+	return func(opts *options) {
+		opts.instReq.RestrictToNamespace = restrict
+	}
+}
+
+// UpdateRestrictToNamespace rejects charts that try to create resources outside their namespace
+func UpdateRestrictToNamespace(restrict bool) UpdateOption {
+	return func(opts *options) {
+		opts.updateReq.RestrictToNamespace = restrict
+	}
+}
+
+// DeleteRestrictToNamespace rejects charts that try to create resources outside their namespace
+func DeleteRestrictToNamespace(restrict bool) DeleteOption {
+	return func(opts *options) {
+		opts.uninstallReq.RestrictToNamespace = restrict
+	}
+}
+
+// RollbackRestrictToNamespace rejects charts that try to create resources outside their namespace
+func RollbackRestrictToNamespace(restrict bool) RollbackOption {
+	return func(opts *options) {
+		opts.rollbackReq.RestrictToNamespace = restrict
+	}
+}
+
 // ContentOption allows setting optional attributes when
 // performing a GetReleaseContent tiller rpc.
 type ContentOption func(*options)

pkg/kube/client.go

@@ -80,7 +80,7 @@ type ResourceActorFunc func(*resource.Info) error
 // Create creates Kubernetes resources from an io.reader.
 //
 // Namespace will set the namespace.
-func (c *Client) Create(namespace string, reader io.Reader, timeout int64, shouldWait bool) error {
+func (c *Client) Create(namespace string, reader io.Reader, timeout int64, shouldWait bool, restrictNs bool) error {
 	client, err := c.ClientSet()
 	if err != nil {
 		return err
@@ -89,7 +89,7 @@ func (c *Client) Create(namespace string, reader io.Reader, timeout int64, shoul
 		return err
 	}
 	c.Log("building resources from manifest")
-	infos, buildErr := c.BuildUnstructured(namespace, reader)
+	infos, buildErr := c.BuildUnstructured(namespace, restrictNs, reader)
 	if buildErr != nil {
 		return buildErr
 	}
@@ -124,13 +124,14 @@ func (c *Client) validator() validation.Schema {
 }
 
 // BuildUnstructured validates for Kubernetes objects and returns unstructured infos.
-func (c *Client) BuildUnstructured(namespace string, reader io.Reader) (Result, error) {
+func (c *Client) BuildUnstructured(namespace string, restrictNs bool, reader io.Reader) (Result, error) {
 	var result Result
 
 	b, err := c.NewUnstructuredBuilder(true)
 	if err != nil {
 		return result, err
 	}
+
 	result, err = b.ContinueOnError().
 		Schema(c.validator()).
 		NamespaceParam(namespace).
@@ -138,24 +139,47 @@ func (c *Client) BuildUnstructured(namespace string, reader io.Reader) (Result,
 		Stream(reader, "").
 		Flatten().
 		Do().Infos()
+
+	if restrictNs {
+		for _, info := range result {
+			if !info.Namespaced() {
+				return nil, fmt.Errorf("resource %q is not namespaced", info.Name)
+			}
+			if info.Namespace != namespace {
+				return nil, fmt.Errorf("resource %q is using wrong namespace %q", info.Name, info.Namespace)
+			}
+		}
+	}
+
 	return result, scrubValidationError(err)
 }
 
 // Build validates for Kubernetes objects and returns resource Infos from a io.Reader.
-func (c *Client) Build(namespace string, reader io.Reader) (Result, error) {
+func (c *Client) Build(namespace string, restrictNs bool, reader io.Reader) (Result, error) {
-	var result Result
 	result, err := c.newBuilder(namespace, reader).Infos()
+
+	if restrictNs {
+		for _, info := range result {
+			if !info.Namespaced() {
+				return nil, fmt.Errorf("resource %q is not namespaced", info.Name)
+			}
+			if info.Namespace != namespace {
+				return nil, fmt.Errorf("resource %q is using wrong namespace %q", info.Name, info.Namespace)
+			}
+		}
+	}
+
 	return result, scrubValidationError(err)
 }
 
 // Get gets Kubernetes resources as pretty-printed string.
 //
 // Namespace will set the namespace.
-func (c *Client) Get(namespace string, reader io.Reader) (string, error) {
+func (c *Client) Get(namespace string, restrictNs bool, reader io.Reader) (string, error) {
 	// Since we don't know what order the objects come in, let's group them by the types, so
 	// that when we print them, they come out looking good (headers apply to subgroups, etc.).
 	objs := make(map[string][]runtime.Object)
-	infos, err := c.BuildUnstructured(namespace, reader)
+	infos, err := c.BuildUnstructured(namespace, restrictNs, reader)
 	if err != nil {
 		return "", err
 	}
@@ -231,14 +255,14 @@ func (c *Client) Get(namespace string, reader io.Reader) (string, error) {
 // not present in the target configuration.
 //
 // Namespace will set the namespaces.
-func (c *Client) Update(namespace string, originalReader, targetReader io.Reader, force bool, recreate bool, timeout int64, shouldWait bool) error {
+func (c *Client) Update(namespace string, originalReader, targetReader io.Reader, force bool, recreate bool, timeout int64, shouldWait, restrictNs bool) error {
-	original, err := c.BuildUnstructured(namespace, originalReader)
+	original, err := c.BuildUnstructured(namespace, restrictNs, originalReader)
 	if err != nil {
 		return fmt.Errorf("failed decoding reader into objects: %s", err)
 	}
 
 	c.Log("building resources from updated manifest")
-	target, err := c.BuildUnstructured(namespace, targetReader)
+	target, err := c.BuildUnstructured(namespace, restrictNs, targetReader)
 	if err != nil {
 		return fmt.Errorf("failed decoding reader into objects: %s", err)
 	}
@@ -302,8 +326,8 @@ func (c *Client) Update(namespace string, originalReader, targetReader io.Reader
 // Delete deletes Kubernetes resources from an io.reader.
 //
 // Namespace will set the namespace.
-func (c *Client) Delete(namespace string, reader io.Reader) error {
+func (c *Client) Delete(namespace string, restrictNs bool, reader io.Reader) error {
-	infos, err := c.BuildUnstructured(namespace, reader)
+	infos, err := c.BuildUnstructured(namespace, restrictNs, reader)
 	if err != nil {
 		return err
 	}
@@ -340,8 +364,8 @@ func (c *Client) watchTimeout(t time.Duration) ResourceActorFunc {
 //   ascertained by watching the Status fields in a job's output.
 //
 // Handling for other kinds will be added as necessary.
-func (c *Client) WatchUntilReady(namespace string, reader io.Reader, timeout int64, shouldWait bool) error {
+func (c *Client) WatchUntilReady(namespace string, reader io.Reader, timeout int64, shouldWait, restrictNs bool) error {
-	infos, err := c.Build(namespace, reader)
+	infos, err := c.Build(namespace, restrictNs, reader)
 	if err != nil {
 		return err
 	}
@@ -610,8 +634,8 @@ func scrubValidationError(err error) error {
 
 // WaitAndGetCompletedPodPhase waits up to a timeout until a pod enters a completed phase
 // and returns said phase (PodSucceeded or PodFailed qualify).
-func (c *Client) WaitAndGetCompletedPodPhase(namespace string, reader io.Reader, timeout time.Duration) (api.PodPhase, error) {
+func (c *Client) WaitAndGetCompletedPodPhase(namespace string, reader io.Reader, timeout time.Duration, restrictNs bool) (api.PodPhase, error) {
-	infos, err := c.Build(namespace, reader)
+	infos, err := c.Build(namespace, restrictNs, reader)
 	if err != nil {
 		return api.PodUnknown, err
 	}

pkg/kube/client_test.go

@@ -193,7 +193,7 @@ func TestUpdate(t *testing.T) {
 	reaper := &fakeReaper{}
 	rf := &fakeReaperFactory{Factory: f, reaper: reaper}
 	c := newTestClient(rf)
-	if err := c.Update(api.NamespaceDefault, objBody(codec, &listA), objBody(codec, &listB), false, false, 0, false); err != nil {
+	if err := c.Update(api.NamespaceDefault, objBody(codec, &listA), objBody(codec, &listB), false, false, 0, false, true); err != nil {
 		t.Fatal(err)
 	}
 	// TODO: Find a way to test methods that use Client Set
@@ -245,6 +245,18 @@ func TestBuild(t *testing.T) {
 			namespace: "test",
 			reader:    strings.NewReader(guestbookManifest),
 			count:     6,
+		}, {
+			name:       "Invalid scoped resource",
+			namespace:  "test",
+			reader:     strings.NewReader(testNonNamespacedResourceManifest),
+			err:        true,
+			errMessage: `resource "my-node" is not namespaced`,
+		}, {
+			name:       "Invalid namespace in resource",
+			namespace:  "test",
+			reader:     strings.NewReader(testExplicitNamespaceManifest),
+			err:        true,
+			errMessage: `resource "your-secret" is using wrong namespace "kube-system"`,
 		}, {
 			name:        "Invalid schema",
 			namespace:   "test",
@@ -271,7 +283,7 @@ func TestBuild(t *testing.T) {
 		}
 
 		// Test for an invalid manifest
-		infos, err := c.Build(tt.namespace, tt.reader)
+		infos, err := c.Build(tt.namespace, true, tt.reader)
 		if err != nil && err.Error() != tt.errMessage {
 			t.Errorf("%q. expected error message: %v, got %v", tt.name, tt.errMessage, err)
 		} else if err != nil && !tt.err {
@@ -330,7 +342,7 @@ func TestGet(t *testing.T) {
 
 	// Test Success
 	data := strings.NewReader("kind: Pod\napiVersion: v1\nmetadata:\n  name: otter")
-	o, err := c.Get("default", data)
+	o, err := c.Get("default", true, data)
 	if err != nil {
 		t.Errorf("Expected missing results, got %q", err)
 	}
@@ -340,7 +352,7 @@ func TestGet(t *testing.T) {
 
 	// Test failure
 	data = strings.NewReader("kind: Pod\napiVersion: v1\nmetadata:\n  name: starfish")
-	o, err = c.Get("default", data)
+	o, err = c.Get("default", true, data)
 	if err != nil {
 		t.Errorf("Expected missing results, got %q", err)
 	}
@@ -399,7 +411,7 @@ func TestPerform(t *testing.T) {
 			tf.Validator = validator
 		}
 
-		infos, err := c.Build(tt.namespace, tt.reader)
+		infos, err := c.Build(tt.namespace, true, tt.reader)
 		if err != nil && err.Error() != tt.errMessage {
 			t.Errorf("%q. Error while building manifests: %v", tt.name, err)
 		}
@@ -472,7 +484,7 @@ func TestWaitAndGetCompletedPodPhase(t *testing.T) {
 
 		c := newTestClient(f)
 
-		phase, err := c.WaitAndGetCompletedPodPhase("test", objBody(codec, &testPodList), 1*time.Second)
+		phase, err := c.WaitAndGetCompletedPodPhase("test", objBody(codec, &testPodList), 1*time.Second, true)
 		if (err != nil) != tt.err {
 			t.Fatalf("Expected error but there was none.")
 		}
@@ -488,22 +500,22 @@ func TestWaitAndGetCompletedPodPhase(t *testing.T) {
 func TestReal(t *testing.T) {
 	t.Skip("This is a live test, comment this line to run")
 	c := New(nil)
-	if err := c.Create("test", strings.NewReader(guestbookManifest), 300, false); err != nil {
+	if err := c.Create("test", strings.NewReader(guestbookManifest), 300, false, true); err != nil {
 		t.Fatal(err)
 	}
 
 	testSvcEndpointManifest := testServiceManifest + "\n---\n" + testEndpointManifest
 	c = New(nil)
-	if err := c.Create("test-delete", strings.NewReader(testSvcEndpointManifest), 300, false); err != nil {
+	if err := c.Create("test-delete", strings.NewReader(testSvcEndpointManifest), 300, false, true); err != nil {
 		t.Fatal(err)
 	}
 
-	if err := c.Delete("test-delete", strings.NewReader(testEndpointManifest)); err != nil {
+	if err := c.Delete("test-delete", true, strings.NewReader(testEndpointManifest)); err != nil {
 		t.Fatal(err)
 	}
 
 	// ensures that delete does not fail if a resource is not found
-	if err := c.Delete("test-delete", strings.NewReader(testSvcEndpointManifest)); err != nil {
+	if err := c.Delete("test-delete", true, strings.NewReader(testSvcEndpointManifest)); err != nil {
 		t.Fatal(err)
 	}
 }
@@ -542,6 +554,25 @@ subsets:
       - port: 9376
 `
 
+const testNonNamespacedResourceManifest = `
+kind: Node
+apiVersion: v1
+metadata:
+  name: my-node
+spec:
+  unschedulable: true
+`
+
+const testExplicitNamespaceManifest = `
+kind: Secret
+apiVersion: v1
+metadata:
+  name: your-secret
+  namespace: kube-system
+data:
+  password: eW91ciBiYXNlIGFyZSBiZWxvbmcgdG8gdXM=
+`
+
 const guestbookManifest = `
 apiVersion: v1
 kind: Service

pkg/proto/hapi/chart/chart.pb.go

@@ -1,5 +1,6 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
+// Code generated by protoc-gen-go.
 // source: hapi/chart/chart.proto
+// DO NOT EDIT!
 
 /*
 Package chart is a generated protocol buffer package.

pkg/proto/hapi/chart/config.pb.go

@@ -1,5 +1,6 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
+// Code generated by protoc-gen-go.
 // source: hapi/chart/config.proto
+// DO NOT EDIT!
 
 package chart
 
@@ -23,13 +24,6 @@ func (m *Config) String() string            { return proto.CompactTextString(m)
 func (*Config) ProtoMessage()               {}
 func (*Config) Descriptor() ([]byte, []int) { return fileDescriptor1, []int{0} }
 
-func (m *Config) GetRaw() string {
-	if m != nil {
-		return m.Raw
-	}
-	return ""
-}
-
 func (m *Config) GetValues() map[string]*Value {
 	if m != nil {
 		return m.Values
@@ -47,13 +41,6 @@ func (m *Value) String() string            { return proto.CompactTextString(m) }
 func (*Value) ProtoMessage()               {}
 func (*Value) Descriptor() ([]byte, []int) { return fileDescriptor1, []int{1} }
 
-func (m *Value) GetValue() string {
-	if m != nil {
-		return m.Value
-	}
-	return ""
-}
-
 func init() {
 	proto.RegisterType((*Config)(nil), "hapi.chart.Config")
 	proto.RegisterType((*Value)(nil), "hapi.chart.Value")

pkg/proto/hapi/chart/metadata.pb.go

@@ -1,5 +1,6 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
+// Code generated by protoc-gen-go.
 // source: hapi/chart/metadata.proto
+// DO NOT EDIT!
 
 package chart
 
@@ -48,27 +49,6 @@ func (m *Maintainer) String() string            { return proto.CompactTextString
 func (*Maintainer) ProtoMessage()               {}
 func (*Maintainer) Descriptor() ([]byte, []int) { return fileDescriptor2, []int{0} }
 
-func (m *Maintainer) GetName() string {
-	if m != nil {
-		return m.Name
-	}
-	return ""
-}
-
-func (m *Maintainer) GetEmail() string {
-	if m != nil {
-		return m.Email
-	}
-	return ""
-}
-
-func (m *Maintainer) GetUrl() string {
-	if m != nil {
-		return m.Url
-	}
-	return ""
-}
-
 // 	Metadata for a Chart file. This models the structure of a Chart.yaml file.
 //
 // 	Spec: https://k8s.io/helm/blob/master/docs/design/chart_format.md#the-chart-file
@@ -114,48 +94,6 @@ func (m *Metadata) String() string            { return proto.CompactTextString(m
 func (*Metadata) ProtoMessage()               {}
 func (*Metadata) Descriptor() ([]byte, []int) { return fileDescriptor2, []int{1} }
 
-func (m *Metadata) GetName() string {
-	if m != nil {
-		return m.Name
-	}
-	return ""
-}
-
-func (m *Metadata) GetHome() string {
-	if m != nil {
-		return m.Home
-	}
-	return ""
-}
-
-func (m *Metadata) GetSources() []string {
-	if m != nil {
-		return m.Sources
-	}
-	return nil
-}
-
-func (m *Metadata) GetVersion() string {
-	if m != nil {
-		return m.Version
-	}
-	return ""
-}
-
-func (m *Metadata) GetDescription() string {
-	if m != nil {
-		return m.Description
-	}
-	return ""
-}
-
-func (m *Metadata) GetKeywords() []string {
-	if m != nil {
-		return m.Keywords
-	}
-	return nil
-}
-
 func (m *Metadata) GetMaintainers() []*Maintainer {
 	if m != nil {
 		return m.Maintainers
@@ -163,62 +101,6 @@ func (m *Metadata) GetMaintainers() []*Maintainer {
 	return nil
 }
 
-func (m *Metadata) GetEngine() string {
-	if m != nil {
-		return m.Engine
-	}
-	return ""
-}
-
-func (m *Metadata) GetIcon() string {
-	if m != nil {
-		return m.Icon
-	}
-	return ""
-}
-
-func (m *Metadata) GetApiVersion() string {
-	if m != nil {
-		return m.ApiVersion
-	}
-	return ""
-}
-
-func (m *Metadata) GetCondition() string {
-	if m != nil {
-		return m.Condition
-	}
-	return ""
-}
-
-func (m *Metadata) GetTags() string {
-	if m != nil {
-		return m.Tags
-	}
-	return ""
-}
-
-func (m *Metadata) GetAppVersion() string {
-	if m != nil {
-		return m.AppVersion
-	}
-	return ""
-}
-
-func (m *Metadata) GetDeprecated() bool {
-	if m != nil {
-		return m.Deprecated
-	}
-	return false
-}
-
-func (m *Metadata) GetTillerVersion() string {
-	if m != nil {
-		return m.TillerVersion
-	}
-	return ""
-}
-
 func (m *Metadata) GetAnnotations() map[string]string {
 	if m != nil {
 		return m.Annotations

pkg/proto/hapi/chart/template.pb.go

@@ -1,5 +1,6 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
+// Code generated by protoc-gen-go.
 // source: hapi/chart/template.proto
+// DO NOT EDIT!
 
 package chart
 
@@ -28,20 +29,6 @@ func (m *Template) String() string            { return proto.CompactTextString(m
 func (*Template) ProtoMessage()               {}
 func (*Template) Descriptor() ([]byte, []int) { return fileDescriptor3, []int{0} }
 
-func (m *Template) GetName() string {
-	if m != nil {
-		return m.Name
-	}
-	return ""
-}
-
-func (m *Template) GetData() []byte {
-	if m != nil {
-		return m.Data
-	}
-	return nil
-}
-
 func init() {
 	proto.RegisterType((*Template)(nil), "hapi.chart.Template")
 }

pkg/proto/hapi/release/hook.pb.go

@@ -1,14 +1,25 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
+// Code generated by protoc-gen-go.
 // source: hapi/release/hook.proto
+// DO NOT EDIT!
 
 /*
 Package release is a generated protocol buffer package.
 
 It is generated from these files:
 	hapi/release/hook.proto
+	hapi/release/info.proto
+	hapi/release/release.proto
+	hapi/release/status.proto
+	hapi/release/test_run.proto
+	hapi/release/test_suite.proto
 
 It has these top-level messages:
 	Hook
+	Info
+	Release
+	Status
+	TestRun
+	TestSuite
 */
 package release
 
@@ -121,41 +132,6 @@ func (m *Hook) String() string            { return proto.CompactTextString(m) }
 func (*Hook) ProtoMessage()               {}
 func (*Hook) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0} }
 
-func (m *Hook) GetName() string {
-	if m != nil {
-		return m.Name
-	}
-	return ""
-}
-
-func (m *Hook) GetKind() string {
-	if m != nil {
-		return m.Kind
-	}
-	return ""
-}
-
-func (m *Hook) GetPath() string {
-	if m != nil {
-		return m.Path
-	}
-	return ""
-}
-
-func (m *Hook) GetManifest() string {
-	if m != nil {
-		return m.Manifest
-	}
-	return ""
-}
-
-func (m *Hook) GetEvents() []Hook_Event {
-	if m != nil {
-		return m.Events
-	}
-	return nil
-}
-
 func (m *Hook) GetLastRun() *google_protobuf.Timestamp {
 	if m != nil {
 		return m.LastRun
@@ -163,20 +139,6 @@ func (m *Hook) GetLastRun() *google_protobuf.Timestamp {
 	return nil
 }
 
-func (m *Hook) GetWeight() int32 {
-	if m != nil {
-		return m.Weight
-	}
-	return 0
-}
-
-func (m *Hook) GetDeletePolicies() []Hook_DeletePolicy {
-	if m != nil {
-		return m.DeletePolicies
-	}
-	return nil
-}
-
 func init() {
 	proto.RegisterType((*Hook)(nil), "hapi.release.Hook")
 	proto.RegisterEnum("hapi.release.Hook_Event", Hook_Event_name, Hook_Event_value)

pkg/proto/hapi/release/info.pb.go

@@ -1,5 +1,6 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
+// Code generated by protoc-gen-go.
 // source: hapi/release/info.proto
+// DO NOT EDIT!
 
 package release
 
@@ -21,7 +22,7 @@ type Info struct {
 	// Deleted tracks when this object was deleted.
 	Deleted *google_protobuf.Timestamp `protobuf:"bytes,4,opt,name=deleted" json:"deleted,omitempty"`
 	// Description is human-friendly "log entry" about this release.
-	Description string `protobuf:"bytes,5,opt,name=Description" json:"Description,omitempty"`
+	Description string `protobuf:"bytes,5,opt,name=Description,json=description" json:"Description,omitempty"`
 }
 
 func (m *Info) Reset()                    { *m = Info{} }
@@ -57,13 +58,6 @@ func (m *Info) GetDeleted() *google_protobuf.Timestamp {
 	return nil
 }
 
-func (m *Info) GetDescription() string {
-	if m != nil {
-		return m.Description
-	}
-	return ""
-}
-
 func init() {
 	proto.RegisterType((*Info)(nil), "hapi.release.Info")
 }
@@ -71,20 +65,20 @@ func init() {
 func init() { proto.RegisterFile("hapi/release/info.proto", fileDescriptor1) }
 
 var fileDescriptor1 = []byte{
-	// 235 bytes of a gzipped FileDescriptorProto
+	// 236 bytes of a gzipped FileDescriptorProto
 	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x84, 0x8f, 0x31, 0x4f, 0xc3, 0x30,
-	0x10, 0x85, 0x95, 0x52, 0x5a, 0xd5, 0x6d, 0x19, 0x2c, 0x24, 0x42, 0x16, 0x22, 0xa6, 0x0e, 0xc8,
+	0x10, 0x85, 0x95, 0x52, 0x5a, 0xd5, 0x69, 0x19, 0x2c, 0x24, 0x42, 0x16, 0x22, 0xa6, 0x0e, 0xc8,
 	0x91, 0x80, 0x1d, 0x81, 0xba, 0xb0, 0x06, 0x26, 0x16, 0xe4, 0xe2, 0x73, 0xb1, 0xe4, 0xe6, 0x2c,
-	0xfb, 0x3a, 0xf0, 0x2f, 0xf8, 0xc9, 0xa8, 0xb6, 0x83, 0xd2, 0xa9, 0xab, 0xbf, 0xf7, 0x3e, 0xbf,
+	0xfb, 0x3a, 0xf0, 0x2f, 0xf8, 0xc9, 0xa8, 0xb6, 0x03, 0x65, 0xea, 0xea, 0xef, 0xbd, 0xcf, 0xef,
-	0x63, 0x57, 0xdf, 0xd2, 0x99, 0xc6, 0x83, 0x05, 0x19, 0xa0, 0x31, 0x9d, 0x46, 0xe1, 0x3c, 0x12,
+	0xd8, 0xc5, 0xa7, 0x74, 0xa6, 0xf5, 0x60, 0x41, 0x06, 0x68, 0x4d, 0xaf, 0x51, 0x38, 0x8f, 0x84,
-	0xf2, 0xc5, 0x01, 0x88, 0x0c, 0xaa, 0x9b, 0x2d, 0xe2, 0xd6, 0x42, 0x13, 0xd9, 0x66, 0xaf, 0x1b,
+	0x7c, 0xbe, 0x07, 0x22, 0x83, 0xfa, 0x6a, 0x83, 0xb8, 0xb1, 0xd0, 0x46, 0xb6, 0xde, 0xe9, 0x96,
-	0x32, 0x3b, 0x08, 0x24, 0x77, 0x2e, 0xc5, 0xab, 0xeb, 0x23, 0x4f, 0x20, 0x49, 0xfb, 0x90, 0xd0,
+	0xcc, 0x16, 0x02, 0xc9, 0xad, 0x4b, 0xf1, 0xfa, 0xf2, 0x9f, 0x27, 0x90, 0xa4, 0x5d, 0x48, 0xe8,
-	0xed, 0xef, 0x88, 0x8d, 0x5f, 0x3b, 0x8d, 0xfc, 0x8e, 0x4d, 0x12, 0x28, 0x8b, 0xba, 0x58, 0xcd,
+	0xfa, 0x7b, 0xc4, 0xc6, 0xcf, 0xbd, 0x46, 0x7e, 0xc3, 0x26, 0x09, 0x54, 0x45, 0x53, 0x2c, 0xcb,
-	0xef, 0x2f, 0xc5, 0xf0, 0x0f, 0xf1, 0x16, 0x59, 0x9b, 0x33, 0xfc, 0x99, 0x5d, 0x68, 0xe3, 0x03,
+	0xdb, 0x73, 0x71, 0xf8, 0x87, 0x78, 0x89, 0xac, 0xcb, 0x19, 0xfe, 0xc8, 0xce, 0xb4, 0xf1, 0x81,
-	0x7d, 0x2a, 0x70, 0x16, 0x7f, 0x40, 0x95, 0xa3, 0xd8, 0xaa, 0x44, 0xda, 0x22, 0xfa, 0x2d, 0xe2,
+	0xde, 0x15, 0x38, 0x8b, 0x5f, 0xa0, 0xaa, 0x51, 0x6c, 0xd5, 0x22, 0x6d, 0x11, 0xc3, 0x16, 0xf1,
-	0xbd, 0xdf, 0xd2, 0x2e, 0x63, 0x63, 0x9d, 0x0b, 0xfc, 0x89, 0x2d, 0xad, 0x1c, 0x1a, 0xce, 0x4e,
+	0x3a, 0x6c, 0xe9, 0x16, 0xb1, 0xb1, 0xca, 0x05, 0xfe, 0xc0, 0x16, 0x56, 0x1e, 0x1a, 0x4e, 0x8e,
-	0x1a, 0x16, 0x87, 0xc2, 0xbf, 0xe0, 0x91, 0x4d, 0x15, 0x58, 0x20, 0x50, 0xe5, 0xf8, 0x64, 0xb5,
+	0x1a, 0xe6, 0xfb, 0xc2, 0xaf, 0xe0, 0x9e, 0x4d, 0x15, 0x58, 0x20, 0x50, 0xd5, 0xf8, 0x68, 0x75,
-	0x8f, 0xf2, 0x9a, 0xcd, 0xd7, 0x10, 0xbe, 0xbc, 0x71, 0x64, 0xb0, 0x2b, 0xcf, 0xeb, 0x62, 0x35,
+	0x88, 0xf2, 0x86, 0x95, 0x2b, 0x08, 0x1f, 0xde, 0x38, 0x32, 0xd8, 0x57, 0xa7, 0x4d, 0xb1, 0x9c,
-	0x6b, 0x87, 0x4f, 0x2f, 0xb3, 0x8f, 0x69, 0xbe, 0x7a, 0x33, 0x89, 0xa6, 0x87, 0xbf, 0x00, 0x00,
+	0x75, 0xa5, 0xfa, 0x7b, 0x7a, 0x9a, 0xbd, 0x4d, 0xf3, 0xd5, 0xeb, 0x49, 0x34, 0xdd, 0xfd, 0x04,
-	0x00, 0xff, 0xff, 0x1a, 0x52, 0x8f, 0x9c, 0x89, 0x01, 0x00, 0x00,
+	0x00, 0x00, 0xff, 0xff, 0x1e, 0x2a, 0x57, 0x7d, 0x89, 0x01, 0x00, 0x00,
 }

pkg/proto/hapi/release/release.pb.go

@@ -1,5 +1,6 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
+// Code generated by protoc-gen-go.
 // source: hapi/release/release.proto
+// DO NOT EDIT!
 
 package release
 
@@ -41,13 +42,6 @@ func (m *Release) String() string            { return proto.CompactTextString(m)
 func (*Release) ProtoMessage()               {}
 func (*Release) Descriptor() ([]byte, []int) { return fileDescriptor2, []int{0} }
 
-func (m *Release) GetName() string {
-	if m != nil {
-		return m.Name
-	}
-	return ""
-}
-
 func (m *Release) GetInfo() *Info {
 	if m != nil {
 		return m.Info
@@ -69,13 +63,6 @@ func (m *Release) GetConfig() *hapi_chart.Config {
 	return nil
 }
 
-func (m *Release) GetManifest() string {
-	if m != nil {
-		return m.Manifest
-	}
-	return ""
-}
-
 func (m *Release) GetHooks() []*Hook {
 	if m != nil {
 		return m.Hooks
@@ -83,20 +70,6 @@ func (m *Release) GetHooks() []*Hook {
 	return nil
 }
 
-func (m *Release) GetVersion() int32 {
-	if m != nil {
-		return m.Version
-	}
-	return 0
-}
-
-func (m *Release) GetNamespace() string {
-	if m != nil {
-		return m.Namespace
-	}
-	return ""
-}
-
 func init() {
 	proto.RegisterType((*Release)(nil), "hapi.release.Release")
 }

pkg/proto/hapi/release/status.pb.go

@@ -1,5 +1,6 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
+// Code generated by protoc-gen-go.
 // source: hapi/release/status.proto
+// DO NOT EDIT!
 
 package release
 
@@ -80,27 +81,6 @@ func (m *Status) String() string            { return proto.CompactTextString(m)
 func (*Status) ProtoMessage()               {}
 func (*Status) Descriptor() ([]byte, []int) { return fileDescriptor3, []int{0} }
 
-func (m *Status) GetCode() Status_Code {
-	if m != nil {
-		return m.Code
-	}
-	return Status_UNKNOWN
-}
-
-func (m *Status) GetResources() string {
-	if m != nil {
-		return m.Resources
-	}
-	return ""
-}
-
-func (m *Status) GetNotes() string {
-	if m != nil {
-		return m.Notes
-	}
-	return ""
-}
-
 func (m *Status) GetLastTestSuiteRun() *TestSuite {
 	if m != nil {
 		return m.LastTestSuiteRun

pkg/proto/hapi/release/test_run.pb.go

@@ -1,5 +1,6 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
+// Code generated by protoc-gen-go.
 // source: hapi/release/test_run.proto
+// DO NOT EDIT!
 
 package release
 
@@ -53,27 +54,6 @@ func (m *TestRun) String() string            { return proto.CompactTextString(m)
 func (*TestRun) ProtoMessage()               {}
 func (*TestRun) Descriptor() ([]byte, []int) { return fileDescriptor4, []int{0} }
 
-func (m *TestRun) GetName() string {
-	if m != nil {
-		return m.Name
-	}
-	return ""
-}
-
-func (m *TestRun) GetStatus() TestRun_Status {
-	if m != nil {
-		return m.Status
-	}
-	return TestRun_UNKNOWN
-}
-
-func (m *TestRun) GetInfo() string {
-	if m != nil {
-		return m.Info
-	}
-	return ""
-}
-
 func (m *TestRun) GetStartedAt() *google_protobuf.Timestamp {
 	if m != nil {
 		return m.StartedAt

pkg/proto/hapi/release/test_suite.pb.go

@@ -1,5 +1,6 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
+// Code generated by protoc-gen-go.
 // source: hapi/release/test_suite.proto
+// DO NOT EDIT!
 
 package release
 

pkg/proto/hapi/rudder/rudder.pb.go

@@ -1,5 +1,6 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
+// Code generated by protoc-gen-go.
 // source: hapi/rudder/rudder.proto
+// DO NOT EDIT!
 
 /*
 Package rudder is a generated protocol buffer package.
@@ -87,20 +88,6 @@ func (m *Result) String() string            { return proto.CompactTextString(m)
 func (*Result) ProtoMessage()               {}
 func (*Result) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0} }
 
-func (m *Result) GetInfo() string {
-	if m != nil {
-		return m.Info
-	}
-	return ""
-}
-
-func (m *Result) GetLog() []string {
-	if m != nil {
-		return m.Log
-	}
-	return nil
-}
-
 type VersionReleaseRequest struct {
 }
 
@@ -119,20 +106,6 @@ func (m *VersionReleaseResponse) String() string            { return proto.Compa
 func (*VersionReleaseResponse) ProtoMessage()               {}
 func (*VersionReleaseResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{2} }
 
-func (m *VersionReleaseResponse) GetName() string {
-	if m != nil {
-		return m.Name
-	}
-	return ""
-}
-
-func (m *VersionReleaseResponse) GetVersion() string {
-	if m != nil {
-		return m.Version
-	}
-	return ""
-}
-
 type InstallReleaseRequest struct {
 	Release *hapi_release5.Release `protobuf:"bytes,1,opt,name=release" json:"release,omitempty"`
 }
@@ -216,10 +189,10 @@ func (m *DeleteReleaseResponse) GetResult() *Result {
 type UpgradeReleaseRequest struct {
 	Current  *hapi_release5.Release `protobuf:"bytes,1,opt,name=current" json:"current,omitempty"`
 	Target   *hapi_release5.Release `protobuf:"bytes,2,opt,name=target" json:"target,omitempty"`
-	Timeout  int64                  `protobuf:"varint,3,opt,name=Timeout" json:"Timeout,omitempty"`
+	Timeout  int64                  `protobuf:"varint,3,opt,name=Timeout,json=timeout" json:"Timeout,omitempty"`
-	Wait     bool                   `protobuf:"varint,4,opt,name=Wait" json:"Wait,omitempty"`
+	Wait     bool                   `protobuf:"varint,4,opt,name=Wait,json=wait" json:"Wait,omitempty"`
-	Recreate bool                   `protobuf:"varint,5,opt,name=Recreate" json:"Recreate,omitempty"`
+	Recreate bool                   `protobuf:"varint,5,opt,name=Recreate,json=recreate" json:"Recreate,omitempty"`
-	Force    bool                   `protobuf:"varint,6,opt,name=Force" json:"Force,omitempty"`
+	Force    bool                   `protobuf:"varint,6,opt,name=Force,json=force" json:"Force,omitempty"`
 }
 
 func (m *UpgradeReleaseRequest) Reset()                    { *m = UpgradeReleaseRequest{} }
@@ -241,34 +214,6 @@ func (m *UpgradeReleaseRequest) GetTarget() *hapi_release5.Release {
 	return nil
 }
 
-func (m *UpgradeReleaseRequest) GetTimeout() int64 {
-	if m != nil {
-		return m.Timeout
-	}
-	return 0
-}
-
-func (m *UpgradeReleaseRequest) GetWait() bool {
-	if m != nil {
-		return m.Wait
-	}
-	return false
-}
-
-func (m *UpgradeReleaseRequest) GetRecreate() bool {
-	if m != nil {
-		return m.Recreate
-	}
-	return false
-}
-
-func (m *UpgradeReleaseRequest) GetForce() bool {
-	if m != nil {
-		return m.Force
-	}
-	return false
-}
-
 type UpgradeReleaseResponse struct {
 	Release *hapi_release5.Release `protobuf:"bytes,1,opt,name=release" json:"release,omitempty"`
 	Result  *Result                `protobuf:"bytes,2,opt,name=result" json:"result,omitempty"`
@@ -296,10 +241,10 @@ func (m *UpgradeReleaseResponse) GetResult() *Result {
 type RollbackReleaseRequest struct {
 	Current  *hapi_release5.Release `protobuf:"bytes,1,opt,name=current" json:"current,omitempty"`
 	Target   *hapi_release5.Release `protobuf:"bytes,2,opt,name=target" json:"target,omitempty"`
-	Timeout  int64                  `protobuf:"varint,3,opt,name=Timeout" json:"Timeout,omitempty"`
+	Timeout  int64                  `protobuf:"varint,3,opt,name=Timeout,json=timeout" json:"Timeout,omitempty"`
-	Wait     bool                   `protobuf:"varint,4,opt,name=Wait" json:"Wait,omitempty"`
+	Wait     bool                   `protobuf:"varint,4,opt,name=Wait,json=wait" json:"Wait,omitempty"`
-	Recreate bool                   `protobuf:"varint,5,opt,name=Recreate" json:"Recreate,omitempty"`
+	Recreate bool                   `protobuf:"varint,5,opt,name=Recreate,json=recreate" json:"Recreate,omitempty"`
-	Force    bool                   `protobuf:"varint,6,opt,name=Force" json:"Force,omitempty"`
+	Force    bool                   `protobuf:"varint,6,opt,name=Force,json=force" json:"Force,omitempty"`
 }
 
 func (m *RollbackReleaseRequest) Reset()                    { *m = RollbackReleaseRequest{} }
@@ -321,34 +266,6 @@ func (m *RollbackReleaseRequest) GetTarget() *hapi_release5.Release {
 	return nil
 }
 
-func (m *RollbackReleaseRequest) GetTimeout() int64 {
-	if m != nil {
-		return m.Timeout
-	}
-	return 0
-}
-
-func (m *RollbackReleaseRequest) GetWait() bool {
-	if m != nil {
-		return m.Wait
-	}
-	return false
-}
-
-func (m *RollbackReleaseRequest) GetRecreate() bool {
-	if m != nil {
-		return m.Recreate
-	}
-	return false
-}
-
-func (m *RollbackReleaseRequest) GetForce() bool {
-	if m != nil {
-		return m.Force
-	}
-	return false
-}
-
 type RollbackReleaseResponse struct {
 	Release *hapi_release5.Release `protobuf:"bytes,1,opt,name=release" json:"release,omitempty"`
 	Result  *Result                `protobuf:"bytes,2,opt,name=result" json:"result,omitempty"`
@@ -680,43 +597,43 @@ var _ReleaseModuleService_serviceDesc = grpc.ServiceDesc{
 func init() { proto.RegisterFile("hapi/rudder/rudder.proto", fileDescriptor0) }
 
 var fileDescriptor0 = []byte{
-	// 597 bytes of a gzipped FileDescriptorProto
+	// 603 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xdc, 0x56, 0x5f, 0x8f, 0xd2, 0x4e,
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xdc, 0x56, 0x5d, 0x8f, 0xd2, 0x40,
-	0x14, 0xa5, 0xb0, 0x14, 0xb8, 0x64, 0x7f, 0x3f, 0x32, 0xa1, 0xd0, 0x34, 0x3e, 0x90, 0x3e, 0x18,
+	0x14, 0xa5, 0x0b, 0x14, 0xb8, 0x64, 0x95, 0x4c, 0x28, 0x34, 0x8d, 0x0f, 0xa4, 0x0f, 0x86, 0xb8,
-	0xe2, 0xba, 0x25, 0x41, 0x1f, 0x7d, 0x51, 0x96, 0xfd, 0x13, 0x23, 0x9b, 0x0c, 0xe2, 0x26, 0xbe,
+	0x6e, 0x49, 0xd0, 0x47, 0x5f, 0x94, 0x65, 0x3f, 0x62, 0x64, 0x93, 0x41, 0xdc, 0xc4, 0xb7, 0x2e,
-	0x75, 0xe1, 0x82, 0xd5, 0xd2, 0xd6, 0xe9, 0x74, 0x1f, 0xd5, 0x4f, 0xe3, 0x57, 0xd2, 0x8f, 0x63,
+	0x5c, 0xb0, 0x5a, 0xda, 0x3a, 0x9d, 0xae, 0x6f, 0xea, 0xaf, 0xf1, 0x2f, 0xe9, 0xcf, 0x31, 0xed,
-	0xda, 0x69, 0x89, 0xad, 0xd3, 0x88, 0x6b, 0xc2, 0x83, 0x4f, 0x9d, 0xe9, 0x3d, 0xdc, 0x39, 0xe7,
+	0xb4, 0x1b, 0x5b, 0xa7, 0x11, 0xd7, 0x84, 0x07, 0x9f, 0x3a, 0xd3, 0x7b, 0xb8, 0x73, 0xce, 0xe9,
-	0xf4, 0xce, 0x09, 0xa0, 0xbf, 0xb3, 0x03, 0x67, 0xc4, 0xa2, 0xd5, 0x0a, 0x59, 0xfa, 0xb0, 0x02,
+	0x9d, 0x13, 0x40, 0x7f, 0x67, 0x07, 0xce, 0x88, 0x45, 0xab, 0x15, 0xb2, 0xf4, 0x61, 0x05, 0xcc,
-	0xe6, 0x73, 0x9f, 0x74, 0xe3, 0x8a, 0x15, 0x22, 0xbb, 0x73, 0x96, 0x18, 0x5a, 0xa2, 0x66, 0xf4,
+	0xe7, 0x3e, 0xe9, 0xc6, 0x15, 0x2b, 0x44, 0x76, 0xe3, 0x2c, 0x31, 0xb4, 0x44, 0xcd, 0xe8, 0x0b,
-	0x05, 0x1e, 0x5d, 0xb4, 0x43, 0x1c, 0x39, 0xde, 0xda, 0x17, 0x70, 0xc3, 0xc8, 0x15, 0xd2, 0xa7,
+	0x3c, 0xba, 0x68, 0x87, 0x38, 0x72, 0xbc, 0xb5, 0x2f, 0xe0, 0x86, 0x91, 0x2b, 0xa4, 0x4f, 0x51,
-	0xa8, 0x99, 0x2e, 0xa8, 0x14, 0xc3, 0xc8, 0xe5, 0x84, 0xc0, 0x51, 0xfc, 0x1b, 0x5d, 0x19, 0x28,
+	0x33, 0x5d, 0x50, 0x29, 0x86, 0x91, 0xcb, 0x09, 0x81, 0x5a, 0xfc, 0x1b, 0x5d, 0x19, 0x28, 0xc3,
-	0xc3, 0x16, 0x4d, 0xd6, 0xa4, 0x03, 0x35, 0xd7, 0xdf, 0xe8, 0xd5, 0x41, 0x6d, 0xd8, 0xa2, 0xf1,
+	0x16, 0x4d, 0xd6, 0xa4, 0x03, 0x55, 0xd7, 0xdf, 0xe8, 0x07, 0x83, 0xea, 0xb0, 0x45, 0xe3, 0xa5,
-	0xd2, 0x7c, 0x06, 0xea, 0x9c, 0xdb, 0x3c, 0x0a, 0x49, 0x1b, 0x1a, 0x8b, 0xd9, 0xcb, 0xd9, 0xf5,
+	0xf9, 0x0c, 0xd4, 0x39, 0xb7, 0x79, 0x14, 0x92, 0x36, 0x34, 0x16, 0xb3, 0x97, 0xb3, 0xcb, 0xab,
-	0xcd, 0xac, 0x53, 0x89, 0x37, 0xf3, 0xc5, 0x64, 0x32, 0x9d, 0xcf, 0x3b, 0x0a, 0x39, 0x86, 0xd6,
+	0x59, 0xa7, 0x12, 0x6f, 0xe6, 0x8b, 0xc9, 0x64, 0x3a, 0x9f, 0x77, 0x14, 0x72, 0x08, 0xad, 0xc5,
-	0x62, 0x36, 0xb9, 0x7c, 0x3e, 0xbb, 0x98, 0x9e, 0x75, 0xaa, 0xa4, 0x05, 0xf5, 0x29, 0xa5, 0xd7,
+	0x6c, 0x72, 0xfe, 0x7c, 0x76, 0x36, 0x3d, 0xe9, 0x1c, 0x90, 0x16, 0xd4, 0xa7, 0x94, 0x5e, 0xd2,
-	0xb4, 0x53, 0x33, 0xfb, 0xa0, 0xbd, 0x41, 0x16, 0x3a, 0xbe, 0x47, 0x05, 0x0b, 0x8a, 0x1f, 0x23,
+	0x4e, 0xd5, 0xec, 0x83, 0xf6, 0x06, 0x59, 0xe8, 0xf8, 0x1e, 0x15, 0x2c, 0x28, 0x7e, 0x8c, 0x30,
-	0x0c, 0xb9, 0x79, 0x0e, 0xbd, 0x62, 0x21, 0x0c, 0x7c, 0x2f, 0xc4, 0x98, 0x96, 0x67, 0x6f, 0x31,
+	0xe4, 0xe6, 0x29, 0xf4, 0x8a, 0x85, 0x30, 0xf0, 0xbd, 0x10, 0x63, 0x5a, 0x9e, 0xbd, 0xc5, 0x8c,
-	0xa3, 0x15, 0xaf, 0x89, 0x0e, 0x8d, 0x3b, 0x81, 0xd6, 0xab, 0xc9, 0xeb, 0x6c, 0x6b, 0x5e, 0x82,
+	0x56, 0xbc, 0x26, 0x3a, 0x34, 0x6e, 0x04, 0x5a, 0x3f, 0x48, 0x5e, 0x67, 0x5b, 0xf3, 0x1c, 0xb4,
-	0x76, 0xe5, 0x85, 0xdc, 0x76, 0xdd, 0xfc, 0x01, 0x64, 0x04, 0x8d, 0x54, 0x78, 0xd2, 0xa9, 0x3d,
+	0x0b, 0x2f, 0xe4, 0xb6, 0xeb, 0xe6, 0x0f, 0x20, 0x23, 0x68, 0xa4, 0xc2, 0x93, 0x4e, 0xed, 0xb1,
-	0xd6, 0xac, 0xc4, 0xc4, 0xcc, 0x8d, 0x0c, 0x9e, 0xa1, 0xcc, 0xcf, 0xd0, 0x2b, 0x76, 0x4a, 0x19,
+	0x66, 0x25, 0x26, 0x66, 0x6e, 0x64, 0xf0, 0x0c, 0x65, 0x7e, 0x81, 0x5e, 0xb1, 0x53, 0xca, 0xe8,
-	0xfd, 0x69, 0x2b, 0xf2, 0x14, 0x54, 0x96, 0x78, 0x9c, 0xb0, 0x6d, 0x8f, 0x1f, 0x58, 0xb2, 0xef,
+	0x6f, 0x5b, 0x91, 0xa7, 0xa0, 0xb2, 0xc4, 0xe3, 0x84, 0x6d, 0x7b, 0xfc, 0xc0, 0x92, 0x7d, 0x3f,
-	0x67, 0x89, 0xef, 0x40, 0x53, 0xac, 0x79, 0x01, 0xdd, 0x33, 0x74, 0x91, 0xe3, 0xdf, 0x2a, 0xf9,
+	0x4b, 0x7c, 0x07, 0x9a, 0x62, 0xcd, 0x33, 0xe8, 0x9e, 0xa0, 0x8b, 0x1c, 0xff, 0x55, 0xc9, 0x67,
-	0x04, 0x5a, 0xa1, 0xd1, 0x61, 0x85, 0x7c, 0x53, 0x40, 0x5b, 0x04, 0x1b, 0x66, 0xaf, 0x24, 0x52,
+	0xd0, 0x0a, 0x8d, 0xf6, 0x2b, 0xe4, 0xbb, 0x02, 0xda, 0x22, 0xd8, 0x30, 0x7b, 0x25, 0x91, 0xb2,
-	0x96, 0x11, 0x63, 0xe8, 0xf1, 0xdf, 0x10, 0x48, 0x51, 0xe4, 0x14, 0x54, 0x6e, 0xb3, 0x0d, 0x66,
+	0x8c, 0x18, 0x43, 0x8f, 0xff, 0x81, 0x40, 0x8a, 0x22, 0xc7, 0xa0, 0x72, 0x9b, 0x6d, 0x30, 0x23,
-	0x04, 0x4a, 0xf0, 0x29, 0x28, 0x9e, 0x93, 0xd7, 0xce, 0x16, 0xfd, 0x88, 0xeb, 0xb5, 0x81, 0x32,
+	0x50, 0x82, 0x4f, 0x41, 0xf1, 0x9c, 0xbc, 0x76, 0xb6, 0xe8, 0x47, 0x5c, 0xaf, 0x0e, 0x94, 0x61,
-	0xac, 0xd1, 0x6c, 0x1b, 0x4f, 0xd5, 0x8d, 0xed, 0x70, 0xfd, 0x68, 0xa0, 0x0c, 0x9b, 0x34, 0x59,
+	0x95, 0x36, 0xb8, 0xd8, 0xc6, 0x53, 0x75, 0x65, 0x3b, 0x5c, 0xaf, 0x0d, 0x94, 0x61, 0x93, 0xd6,
-	0x13, 0x03, 0x9a, 0x14, 0x97, 0x0c, 0x6d, 0x8e, 0x7a, 0x3d, 0x79, 0xbf, 0xdb, 0x93, 0x2e, 0xd4,
+	0x3e, 0xd9, 0x0e, 0x27, 0x06, 0x34, 0x29, 0x2e, 0x19, 0xda, 0x1c, 0xf5, 0x7a, 0xf2, 0xbe, 0xc9,
-	0xcf, 0x7d, 0xb6, 0x44, 0x5d, 0x4d, 0x0a, 0x62, 0x13, 0xcf, 0x48, 0x51, 0xd8, 0x61, 0xad, 0xfd,
+	0xd2, 0x3d, 0xe9, 0x42, 0xfd, 0xd4, 0x67, 0x4b, 0xd4, 0xd5, 0xa4, 0x50, 0x5f, 0xc7, 0x9b, 0x78,
-	0xae, 0x40, 0x8f, 0xfa, 0xae, 0x7b, 0x6b, 0x2f, 0x3f, 0xfc, 0x63, 0xde, 0x7e, 0x51, 0xa0, 0xff,
+	0x46, 0x8a, 0xc2, 0xf6, 0x6b, 0xed, 0x0f, 0x05, 0x7a, 0xd4, 0x77, 0xdd, 0x6b, 0x7b, 0xf9, 0xe1,
-	0x8b, 0xb4, 0x83, 0xdf, 0xc0, 0xb4, 0x93, 0x88, 0xbc, 0x7b, 0xdf, 0xc0, 0x00, 0xb4, 0x42, 0xa3,
+	0x3f, 0xf3, 0xf6, 0xab, 0x02, 0xfd, 0xdf, 0xa4, 0xed, 0xfd, 0x06, 0xa6, 0x9d, 0x44, 0xe4, 0xdd,
-	0xfb, 0x0a, 0x79, 0x98, 0x86, 0xb4, 0x90, 0x41, 0xf2, 0xe8, 0x2b, 0x6f, 0xed, 0x8b, 0xe0, 0x1e,
+	0xf9, 0x06, 0x06, 0xa0, 0x15, 0x1a, 0xdd, 0x55, 0xc8, 0xc3, 0x34, 0xa4, 0x85, 0x0c, 0x92, 0x47,
-	0x7f, 0xad, 0xef, 0xb8, 0xbf, 0xf2, 0x57, 0x91, 0x8b, 0x73, 0x21, 0x95, 0xac, 0xa1, 0x91, 0x06,
+	0x5f, 0x78, 0x6b, 0x5f, 0x04, 0xf7, 0xf8, 0x5b, 0xfd, 0x96, 0xfb, 0x2b, 0x7f, 0x15, 0xb9, 0x38,
-	0x2d, 0x39, 0x91, 0x9b, 0x20, 0x0d, 0x68, 0xe3, 0xf1, 0x7e, 0x60, 0xa1, 0xcb, 0xac, 0x90, 0x2d,
+	0x17, 0x52, 0xc9, 0x1a, 0x1a, 0x69, 0xd0, 0x92, 0x23, 0xb9, 0x09, 0xd2, 0x80, 0x36, 0x1e, 0xef,
-	0xfc, 0x97, 0x8f, 0xcf, 0xb2, 0xe3, 0xa4, 0x71, 0x5d, 0x76, 0x9c, 0x3c, 0x91, 0xcd, 0x0a, 0x79,
+	0x06, 0x16, 0xba, 0xcc, 0x0a, 0xd9, 0xc2, 0xbd, 0x7c, 0x7c, 0x96, 0x1d, 0x27, 0x8d, 0xeb, 0xb2,
-	0x0f, 0xc7, 0xb9, 0x8c, 0x23, 0x8f, 0xe4, 0x0d, 0x64, 0x89, 0x6a, 0x9c, 0xec, 0x85, 0xdd, 0x9d,
+	0xe3, 0xe4, 0x89, 0x6c, 0x56, 0xc8, 0x7b, 0x38, 0xcc, 0x65, 0x1c, 0x79, 0x24, 0x6f, 0x20, 0x4b,
-	0x15, 0xc0, 0xff, 0x85, 0xc1, 0x24, 0x25, 0x74, 0xe5, 0x57, 0xd3, 0x38, 0xdd, 0x13, 0xfd, 0xb3,
+	0x54, 0xe3, 0x68, 0x27, 0xec, 0xed, 0x59, 0x01, 0xdc, 0x2f, 0x0c, 0x26, 0x29, 0xa1, 0x2b, 0xbf,
-	0x99, 0xf9, 0x9c, 0x29, 0x33, 0x53, 0x1a, 0xb3, 0x65, 0x66, 0xca, 0xa3, 0x4b, 0x98, 0x99, 0x1b,
+	0x9a, 0xc6, 0xf1, 0x8e, 0xe8, 0x5f, 0xcd, 0xcc, 0xe7, 0x4c, 0x99, 0x99, 0xd2, 0x98, 0x2d, 0x33,
-	0xd7, 0x32, 0x33, 0x65, 0x97, 0xa3, 0xcc, 0x4c, 0xe9, 0xfc, 0x9b, 0x95, 0x17, 0xcd, 0xb7, 0xaa,
+	0x53, 0x1e, 0x5d, 0xc2, 0xcc, 0xdc, 0xb8, 0x96, 0x99, 0x29, 0xbb, 0x1c, 0x65, 0x66, 0x4a, 0xe7,
-	0x40, 0xdc, 0xaa, 0xc9, 0x1f, 0x92, 0x27, 0x3f, 0x02, 0x00, 0x00, 0xff, 0xff, 0xb6, 0xa5, 0x37,
+	0xdf, 0xac, 0xbc, 0x68, 0xbe, 0x55, 0x05, 0xe2, 0x5a, 0x4d, 0xfe, 0x90, 0x3c, 0xf9, 0x19, 0x00,
-	0x75, 0xf7, 0x08, 0x00, 0x00,
+	0x00, 0xff, 0xff, 0x29, 0xd8, 0x2b, 0x03, 0xf7, 0x08, 0x00, 0x00,
 }

pkg/proto/hapi/services/tiller.pb.go

@@ -1,5 +1,6 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
+// Code generated by protoc-gen-go.
 // source: hapi/services/tiller.proto
+// DO NOT EDIT!
 
 /*
 Package services is a generated protocol buffer package.
@@ -138,55 +139,6 @@ func (m *ListReleasesRequest) String() string            { return proto.CompactT
 func (*ListReleasesRequest) ProtoMessage()               {}
 func (*ListReleasesRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0} }
 
-func (m *ListReleasesRequest) GetLimit() int64 {
-	if m != nil {
-		return m.Limit
-	}
-	return 0
-}
-
-func (m *ListReleasesRequest) GetOffset() string {
-	if m != nil {
-		return m.Offset
-	}
-	return ""
-}
-
-func (m *ListReleasesRequest) GetSortBy() ListSort_SortBy {
-	if m != nil {
-		return m.SortBy
-	}
-	return ListSort_UNKNOWN
-}
-
-func (m *ListReleasesRequest) GetFilter() string {
-	if m != nil {
-		return m.Filter
-	}
-	return ""
-}
-
-func (m *ListReleasesRequest) GetSortOrder() ListSort_SortOrder {
-	if m != nil {
-		return m.SortOrder
-	}
-	return ListSort_ASC
-}
-
-func (m *ListReleasesRequest) GetStatusCodes() []hapi_release3.Status_Code {
-	if m != nil {
-		return m.StatusCodes
-	}
-	return nil
-}
-
-func (m *ListReleasesRequest) GetNamespace() string {
-	if m != nil {
-		return m.Namespace
-	}
-	return ""
-}
-
 // ListSort defines sorting fields on a release list.
 type ListSort struct {
 }
@@ -214,27 +166,6 @@ func (m *ListReleasesResponse) String() string            { return proto.Compact
 func (*ListReleasesResponse) ProtoMessage()               {}
 func (*ListReleasesResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{2} }
 
-func (m *ListReleasesResponse) GetCount() int64 {
-	if m != nil {
-		return m.Count
-	}
-	return 0
-}
-
-func (m *ListReleasesResponse) GetNext() string {
-	if m != nil {
-		return m.Next
-	}
-	return ""
-}
-
-func (m *ListReleasesResponse) GetTotal() int64 {
-	if m != nil {
-		return m.Total
-	}
-	return 0
-}
-
 func (m *ListReleasesResponse) GetReleases() []*hapi_release5.Release {
 	if m != nil {
 		return m.Releases
@@ -255,20 +186,6 @@ func (m *GetReleaseStatusRequest) String() string            { return proto.Comp
 func (*GetReleaseStatusRequest) ProtoMessage()               {}
 func (*GetReleaseStatusRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{3} }
 
-func (m *GetReleaseStatusRequest) GetName() string {
-	if m != nil {
-		return m.Name
-	}
-	return ""
-}
-
-func (m *GetReleaseStatusRequest) GetVersion() int32 {
-	if m != nil {
-		return m.Version
-	}
-	return 0
-}
-
 // GetReleaseStatusResponse is the response indicating the status of the named release.
 type GetReleaseStatusResponse struct {
 	// Name is the name of the release.
@@ -284,13 +201,6 @@ func (m *GetReleaseStatusResponse) String() string            { return proto.Com
 func (*GetReleaseStatusResponse) ProtoMessage()               {}
 func (*GetReleaseStatusResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{4} }
 
-func (m *GetReleaseStatusResponse) GetName() string {
-	if m != nil {
-		return m.Name
-	}
-	return ""
-}
-
 func (m *GetReleaseStatusResponse) GetInfo() *hapi_release4.Info {
 	if m != nil {
 		return m.Info
@@ -298,13 +208,6 @@ func (m *GetReleaseStatusResponse) GetInfo() *hapi_release4.Info {
 	return nil
 }
 
-func (m *GetReleaseStatusResponse) GetNamespace() string {
-	if m != nil {
-		return m.Namespace
-	}
-	return ""
-}
-
 // GetReleaseContentRequest is a request to get the contents of a release.
 type GetReleaseContentRequest struct {
 	// The name of the release
@@ -318,20 +221,6 @@ func (m *GetReleaseContentRequest) String() string            { return proto.Com
 func (*GetReleaseContentRequest) ProtoMessage()               {}
 func (*GetReleaseContentRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{5} }
 
-func (m *GetReleaseContentRequest) GetName() string {
-	if m != nil {
-		return m.Name
-	}
-	return ""
-}
-
-func (m *GetReleaseContentRequest) GetVersion() int32 {
-	if m != nil {
-		return m.Version
-	}
-	return 0
-}
-
 // GetReleaseContentResponse is a response containing the contents of a release.
 type GetReleaseContentResponse struct {
 	// The release content
@@ -376,6 +265,8 @@ type UpdateReleaseRequest struct {
 	ReuseValues bool `protobuf:"varint,10,opt,name=reuse_values,json=reuseValues" json:"reuse_values,omitempty"`
 	// Force resource update through delete/recreate if needed.
 	Force bool `protobuf:"varint,11,opt,name=force" json:"force,omitempty"`
+	// RestrictToNamespace, if true, will reject a chart that tries to create non-namespaced resources or resources in a namespace other than `namespace`
+	RestrictToNamespace bool `protobuf:"varint,12,opt,name=restrict_to_namespace,json=restrictToNamespace" json:"restrict_to_namespace,omitempty"`
 }
 
 func (m *UpdateReleaseRequest) Reset()                    { *m = UpdateReleaseRequest{} }
@@ -383,13 +274,6 @@ func (m *UpdateReleaseRequest) String() string            { return proto.Compact
 func (*UpdateReleaseRequest) ProtoMessage()               {}
 func (*UpdateReleaseRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{7} }
 
-func (m *UpdateReleaseRequest) GetName() string {
-	if m != nil {
-		return m.Name
-	}
-	return ""
-}
-
 func (m *UpdateReleaseRequest) GetChart() *hapi_chart3.Chart {
 	if m != nil {
 		return m.Chart
@@ -404,62 +288,6 @@ func (m *UpdateReleaseRequest) GetValues() *hapi_chart.Config {
 	return nil
 }
 
-func (m *UpdateReleaseRequest) GetDryRun() bool {
-	if m != nil {
-		return m.DryRun
-	}
-	return false
-}
-
-func (m *UpdateReleaseRequest) GetDisableHooks() bool {
-	if m != nil {
-		return m.DisableHooks
-	}
-	return false
-}
-
-func (m *UpdateReleaseRequest) GetRecreate() bool {
-	if m != nil {
-		return m.Recreate
-	}
-	return false
-}
-
-func (m *UpdateReleaseRequest) GetTimeout() int64 {
-	if m != nil {
-		return m.Timeout
-	}
-	return 0
-}
-
-func (m *UpdateReleaseRequest) GetResetValues() bool {
-	if m != nil {
-		return m.ResetValues
-	}
-	return false
-}
-
-func (m *UpdateReleaseRequest) GetWait() bool {
-	if m != nil {
-		return m.Wait
-	}
-	return false
-}
-
-func (m *UpdateReleaseRequest) GetReuseValues() bool {
-	if m != nil {
-		return m.ReuseValues
-	}
-	return false
-}
-
-func (m *UpdateReleaseRequest) GetForce() bool {
-	if m != nil {
-		return m.Force
-	}
-	return false
-}
-
 // UpdateReleaseResponse is the response to an update request.
 type UpdateReleaseResponse struct {
 	Release *hapi_release5.Release `protobuf:"bytes,1,opt,name=release" json:"release,omitempty"`
@@ -495,6 +323,8 @@ type RollbackReleaseRequest struct {
 	Wait bool `protobuf:"varint,7,opt,name=wait" json:"wait,omitempty"`
 	// Force resource update through delete/recreate if needed.
 	Force bool `protobuf:"varint,8,opt,name=force" json:"force,omitempty"`
+	// RestrictToNamespace, if true, will reject a chart that tries to create non-namespaced resources or resources in a namespace other than `namespace`
+	RestrictToNamespace bool `protobuf:"varint,12,opt,name=restrict_to_namespace,json=restrictToNamespace" json:"restrict_to_namespace,omitempty"`
 }
 
 func (m *RollbackReleaseRequest) Reset()                    { *m = RollbackReleaseRequest{} }
@@ -502,62 +332,6 @@ func (m *RollbackReleaseRequest) String() string            { return proto.Compa
 func (*RollbackReleaseRequest) ProtoMessage()               {}
 func (*RollbackReleaseRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{9} }
 
-func (m *RollbackReleaseRequest) GetName() string {
-	if m != nil {
-		return m.Name
-	}
-	return ""
-}
-
-func (m *RollbackReleaseRequest) GetDryRun() bool {
-	if m != nil {
-		return m.DryRun
-	}
-	return false
-}
-
-func (m *RollbackReleaseRequest) GetDisableHooks() bool {
-	if m != nil {
-		return m.DisableHooks
-	}
-	return false
-}
-
-func (m *RollbackReleaseRequest) GetVersion() int32 {
-	if m != nil {
-		return m.Version
-	}
-	return 0
-}
-
-func (m *RollbackReleaseRequest) GetRecreate() bool {
-	if m != nil {
-		return m.Recreate
-	}
-	return false
-}
-
-func (m *RollbackReleaseRequest) GetTimeout() int64 {
-	if m != nil {
-		return m.Timeout
-	}
-	return 0
-}
-
-func (m *RollbackReleaseRequest) GetWait() bool {
-	if m != nil {
-		return m.Wait
-	}
-	return false
-}
-
-func (m *RollbackReleaseRequest) GetForce() bool {
-	if m != nil {
-		return m.Force
-	}
-	return false
-}
-
 // RollbackReleaseResponse is the response to an update request.
 type RollbackReleaseResponse struct {
 	Release *hapi_release5.Release `protobuf:"bytes,1,opt,name=release" json:"release,omitempty"`
@@ -600,6 +374,8 @@ type InstallReleaseRequest struct {
 	// wait, if true, will wait until all Pods, PVCs, and Services are in a ready state
 	// before marking the release as successful. It will wait for as long as timeout
 	Wait bool `protobuf:"varint,9,opt,name=wait" json:"wait,omitempty"`
+	// RestrictToNamespace, if true, will reject a chart that tries to create non-namespaced resources or resources in a namespace other than `namespace`
+	RestrictToNamespace bool `protobuf:"varint,10,opt,name=restrict_to_namespace,json=restrictToNamespace" json:"restrict_to_namespace,omitempty"`
 }
 
 func (m *InstallReleaseRequest) Reset()                    { *m = InstallReleaseRequest{} }
@@ -621,55 +397,6 @@ func (m *InstallReleaseRequest) GetValues() *hapi_chart.Config {
 	return nil
 }
 
-func (m *InstallReleaseRequest) GetDryRun() bool {
-	if m != nil {
-		return m.DryRun
-	}
-	return false
-}
-
-func (m *InstallReleaseRequest) GetName() string {
-	if m != nil {
-		return m.Name
-	}
-	return ""
-}
-
-func (m *InstallReleaseRequest) GetDisableHooks() bool {
-	if m != nil {
-		return m.DisableHooks
-	}
-	return false
-}
-
-func (m *InstallReleaseRequest) GetNamespace() string {
-	if m != nil {
-		return m.Namespace
-	}
-	return ""
-}
-
-func (m *InstallReleaseRequest) GetReuseName() bool {
-	if m != nil {
-		return m.ReuseName
-	}
-	return false
-}
-
-func (m *InstallReleaseRequest) GetTimeout() int64 {
-	if m != nil {
-		return m.Timeout
-	}
-	return 0
-}
-
-func (m *InstallReleaseRequest) GetWait() bool {
-	if m != nil {
-		return m.Wait
-	}
-	return false
-}
-
 // InstallReleaseResponse is the response from a release installation.
 type InstallReleaseResponse struct {
 	Release *hapi_release5.Release `protobuf:"bytes,1,opt,name=release" json:"release,omitempty"`
@@ -697,6 +424,8 @@ type UninstallReleaseRequest struct {
 	Purge bool `protobuf:"varint,3,opt,name=purge" json:"purge,omitempty"`
 	// timeout specifies the max amount of time any kubernetes client command can run.
 	Timeout int64 `protobuf:"varint,4,opt,name=timeout" json:"timeout,omitempty"`
+	// RestrictToNamespace, if true, will reject a chart that tries to create non-namespaced resources or resources in a namespace other than `namespace`
+	RestrictToNamespace bool `protobuf:"varint,12,opt,name=restrict_to_namespace,json=restrictToNamespace" json:"restrict_to_namespace,omitempty"`
 }
 
 func (m *UninstallReleaseRequest) Reset()                    { *m = UninstallReleaseRequest{} }
@@ -704,34 +433,6 @@ func (m *UninstallReleaseRequest) String() string            { return proto.Comp
 func (*UninstallReleaseRequest) ProtoMessage()               {}
 func (*UninstallReleaseRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{13} }
 
-func (m *UninstallReleaseRequest) GetName() string {
-	if m != nil {
-		return m.Name
-	}
-	return ""
-}
-
-func (m *UninstallReleaseRequest) GetDisableHooks() bool {
-	if m != nil {
-		return m.DisableHooks
-	}
-	return false
-}
-
-func (m *UninstallReleaseRequest) GetPurge() bool {
-	if m != nil {
-		return m.Purge
-	}
-	return false
-}
-
-func (m *UninstallReleaseRequest) GetTimeout() int64 {
-	if m != nil {
-		return m.Timeout
-	}
-	return 0
-}
-
 // UninstallReleaseResponse represents a successful response to an uninstall request.
 type UninstallReleaseResponse struct {
 	// Release is the release that was marked deleted.
@@ -752,13 +453,6 @@ func (m *UninstallReleaseResponse) GetRelease() *hapi_release5.Release {
 	return nil
 }
 
-func (m *UninstallReleaseResponse) GetInfo() string {
-	if m != nil {
-		return m.Info
-	}
-	return ""
-}
-
 // GetVersionRequest requests for version information.
 type GetVersionRequest struct {
 }
@@ -769,7 +463,7 @@ func (*GetVersionRequest) ProtoMessage()               {}
 func (*GetVersionRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{15} }
 
 type GetVersionResponse struct {
-	Version *hapi_version.Version `protobuf:"bytes,1,opt,name=Version" json:"Version,omitempty"`
+	Version *hapi_version.Version `protobuf:"bytes,1,opt,name=Version,json=version" json:"Version,omitempty"`
 }
 
 func (m *GetVersionResponse) Reset()                    { *m = GetVersionResponse{} }
@@ -797,20 +491,6 @@ func (m *GetHistoryRequest) String() string            { return proto.CompactTex
 func (*GetHistoryRequest) ProtoMessage()               {}
 func (*GetHistoryRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{17} }
 
-func (m *GetHistoryRequest) GetName() string {
-	if m != nil {
-		return m.Name
-	}
-	return ""
-}
-
-func (m *GetHistoryRequest) GetMax() int32 {
-	if m != nil {
-		return m.Max
-	}
-	return 0
-}
-
 // GetHistoryResponse is received in response to a GetHistory rpc.
 type GetHistoryResponse struct {
 	Releases []*hapi_release5.Release `protobuf:"bytes,1,rep,name=releases" json:"releases,omitempty"`
@@ -843,27 +523,6 @@ func (m *TestReleaseRequest) String() string            { return proto.CompactTe
 func (*TestReleaseRequest) ProtoMessage()               {}
 func (*TestReleaseRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{19} }
 
-func (m *TestReleaseRequest) GetName() string {
-	if m != nil {
-		return m.Name
-	}
-	return ""
-}
-
-func (m *TestReleaseRequest) GetTimeout() int64 {
-	if m != nil {
-		return m.Timeout
-	}
-	return 0
-}
-
-func (m *TestReleaseRequest) GetCleanup() bool {
-	if m != nil {
-		return m.Cleanup
-	}
-	return false
-}
-
 // TestReleaseResponse represents a message from executing a test
 type TestReleaseResponse struct {
 	Msg    string                       `protobuf:"bytes,1,opt,name=msg" json:"msg,omitempty"`
@@ -875,20 +534,6 @@ func (m *TestReleaseResponse) String() string            { return proto.CompactT
 func (*TestReleaseResponse) ProtoMessage()               {}
 func (*TestReleaseResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{20} }
 
-func (m *TestReleaseResponse) GetMsg() string {
-	if m != nil {
-		return m.Msg
-	}
-	return ""
-}
-
-func (m *TestReleaseResponse) GetStatus() hapi_release1.TestRun_Status {
-	if m != nil {
-		return m.Status
-	}
-	return hapi_release1.TestRun_UNKNOWN
-}
-
 func init() {
 	proto.RegisterType((*ListReleasesRequest)(nil), "hapi.services.tiller.ListReleasesRequest")
 	proto.RegisterType((*ListSort)(nil), "hapi.services.tiller.ListSort")
@@ -1368,82 +1013,84 @@ var _ReleaseService_serviceDesc = grpc.ServiceDesc{
 func init() { proto.RegisterFile("hapi/services/tiller.proto", fileDescriptor0) }
 
 var fileDescriptor0 = []byte{
-	// 1217 bytes of a gzipped FileDescriptorProto
+	// 1250 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x9c, 0x57, 0xdd, 0x6e, 0xe3, 0xc4,
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xa4, 0x57, 0xef, 0x72, 0xdb, 0x44,
-	0x17, 0xaf, 0xf3, 0x9d, 0x93, 0x36, 0xff, 0x74, 0x9a, 0xb6, 0xae, 0xff, 0x0b, 0x2a, 0x46, 0xb0,
+	0x10, 0x8f, 0x2d, 0xff, 0x5d, 0xa7, 0xc6, 0xbd, 0x38, 0x89, 0x2a, 0x0a, 0x13, 0xc4, 0x40, 0xdd,
-	0xd9, 0x85, 0x4d, 0x21, 0x70, 0x83, 0x84, 0x90, 0xba, 0xdd, 0xa8, 0x2d, 0x94, 0xae, 0xe4, 0x6c,
+	0x42, 0x1d, 0x30, 0x7c, 0x61, 0x86, 0x61, 0x26, 0x4d, 0x3d, 0x69, 0x21, 0xb8, 0x33, 0x72, 0x53,
-	0x17, 0x09, 0x01, 0x91, 0x9b, 0x4c, 0x5a, 0xb3, 0x8e, 0x27, 0x78, 0xc6, 0x65, 0x7b, 0xcb, 0x1d,
+	0x66, 0x18, 0xc0, 0xa3, 0xd8, 0xe7, 0x44, 0x54, 0xd6, 0x19, 0xdd, 0x29, 0x34, 0x8f, 0xc0, 0x13,
-	0x8f, 0xc2, 0x5b, 0xf0, 0x1e, 0x5c, 0xc2, 0x83, 0x20, 0xcf, 0x87, 0xeb, 0x49, 0xed, 0xd6, 0xf4,
+	0xc0, 0x93, 0xf0, 0x99, 0xf7, 0x60, 0x78, 0x17, 0x46, 0xf7, 0x47, 0xd1, 0x39, 0x52, 0x22, 0xcc,
-	0x26, 0x9e, 0x99, 0xf3, 0xfd, 0x3b, 0x67, 0xce, 0x9c, 0x80, 0x75, 0xe9, 0x2e, 0xbc, 0x3d, 0x8a,
+	0x17, 0xeb, 0xee, 0x76, 0x6f, 0x77, 0xef, 0xf7, 0xbb, 0xdd, 0x5b, 0x83, 0x75, 0xee, 0x2e, 0xbd,
-	0xc3, 0x2b, 0x6f, 0x82, 0xe9, 0x1e, 0xf3, 0x7c, 0x1f, 0x87, 0xfd, 0x45, 0x48, 0x18, 0x41, 0xdd,
+	0x7d, 0x8a, 0xc3, 0x0b, 0x6f, 0x8a, 0xe9, 0x3e, 0xf3, 0x7c, 0x1f, 0x87, 0xfd, 0x65, 0x48, 0x18,
-	0x98, 0xd6, 0x57, 0xb4, 0xbe, 0xa0, 0x59, 0x5b, 0x5c, 0x62, 0x72, 0xe9, 0x86, 0x4c, 0xfc, 0x0a,
+	0x41, 0xdd, 0x58, 0xd6, 0x57, 0xb2, 0xbe, 0x90, 0x59, 0x3b, 0x7c, 0xc7, 0xf4, 0xdc, 0x0d, 0x99,
-	0x6e, 0x6b, 0x3b, 0x7d, 0x4e, 0x82, 0x99, 0x77, 0x21, 0x09, 0xc2, 0x44, 0x88, 0x7d, 0xec, 0x52,
+	0xf8, 0x15, 0xda, 0xd6, 0x6e, 0x7a, 0x9d, 0x04, 0x73, 0xef, 0x4c, 0x0a, 0x84, 0x8b, 0x10, 0xfb,
-	0xac, 0xbe, 0x9a, 0x90, 0xa2, 0x79, 0xc1, 0x8c, 0x48, 0xc2, 0xff, 0x35, 0x02, 0xc3, 0x94, 0x8d,
+	0xd8, 0xa5, 0x58, 0x7d, 0xb5, 0x4d, 0x4a, 0xe6, 0x05, 0x73, 0x22, 0x05, 0x6f, 0x6b, 0x02, 0x86,
-	0xc3, 0x28, 0x90, 0xc4, 0x1d, 0x8d, 0x48, 0x99, 0xcb, 0x22, 0xaa, 0x19, 0xbb, 0xc2, 0x21, 0xf5,
+	0x29, 0x9b, 0x84, 0x51, 0x20, 0x85, 0xf7, 0x34, 0x21, 0x65, 0x2e, 0x8b, 0xa8, 0xe6, 0xec, 0x02,
-	0x48, 0xa0, 0xbe, 0x82, 0x66, 0xff, 0x59, 0x82, 0x8d, 0x13, 0x8f, 0x32, 0x47, 0x08, 0x52, 0x07,
+	0x87, 0xd4, 0x23, 0x81, 0xfa, 0x0a, 0x99, 0xfd, 0x57, 0x19, 0xb6, 0x8e, 0x3d, 0xca, 0x1c, 0xb1,
-	0xff, 0x12, 0x61, 0xca, 0x50, 0x17, 0xaa, 0xbe, 0x37, 0xf7, 0x98, 0x69, 0xec, 0x1a, 0xbd, 0xb2,
+	0x91, 0x3a, 0xf8, 0x97, 0x08, 0x53, 0x86, 0xba, 0x50, 0xf5, 0xbd, 0x85, 0xc7, 0xcc, 0xd2, 0x5e,
-	0x23, 0x36, 0x68, 0x0b, 0x6a, 0x64, 0x36, 0xa3, 0x98, 0x99, 0xa5, 0x5d, 0xa3, 0xd7, 0x74, 0xe4,
+	0xa9, 0x67, 0x38, 0x62, 0x82, 0x76, 0xa0, 0x46, 0xe6, 0x73, 0x8a, 0x99, 0x59, 0xde, 0x2b, 0xf5,
-	0x0e, 0x7d, 0x05, 0x75, 0x4a, 0x42, 0x36, 0x3e, 0xbf, 0x36, 0xcb, 0xbb, 0x46, 0xaf, 0x3d, 0xf8,
+	0x9a, 0x8e, 0x9c, 0xa1, 0xaf, 0xa0, 0x4e, 0x49, 0xc8, 0x26, 0xa7, 0x97, 0xa6, 0xb1, 0x57, 0xea,
-	0xa0, 0x9f, 0x85, 0x53, 0x3f, 0xb6, 0x34, 0x22, 0x21, 0xeb, 0xc7, 0x3f, 0xcf, 0xaf, 0x9d, 0x1a,
+	0xb5, 0x07, 0x1f, 0xf4, 0xb3, 0x70, 0xea, 0xc7, 0x9e, 0xc6, 0x24, 0x64, 0xfd, 0xf8, 0xe7, 0xc9,
-	0xe5, 0xdf, 0x58, 0xef, 0xcc, 0xf3, 0x19, 0x0e, 0xcd, 0x8a, 0xd0, 0x2b, 0x76, 0xe8, 0x10, 0x80,
+	0xa5, 0x53, 0xa3, 0xfc, 0x1b, 0xdb, 0x9d, 0x7b, 0x3e, 0xc3, 0xa1, 0x59, 0x11, 0x76, 0xc5, 0x0c,
-	0xeb, 0x25, 0xe1, 0x14, 0x87, 0x66, 0x95, 0xab, 0xee, 0x15, 0x50, 0xfd, 0x32, 0xe6, 0x77, 0x9a,
+	0x1d, 0x01, 0x70, 0xbb, 0x24, 0x9c, 0xe1, 0xd0, 0xac, 0x72, 0xd3, 0xbd, 0x02, 0xa6, 0x5f, 0xc4,
-	0x54, 0x2d, 0xd1, 0x97, 0xb0, 0x2a, 0x20, 0x19, 0x4f, 0xc8, 0x14, 0x53, 0xb3, 0xb6, 0x5b, 0xee,
+	0xfa, 0x4e, 0x93, 0xaa, 0x21, 0xfa, 0x12, 0x36, 0x05, 0x24, 0x93, 0x29, 0x99, 0x61, 0x6a, 0xd6,
-	0xb5, 0x07, 0x3b, 0x42, 0x95, 0x82, 0x7f, 0x24, 0x40, 0x3b, 0x20, 0x53, 0xec, 0xb4, 0x04, 0x7b,
+	0xf6, 0x8c, 0x5e, 0x7b, 0x70, 0x4f, 0x98, 0x52, 0xf0, 0x8f, 0x05, 0x68, 0x87, 0x64, 0x86, 0x9d,
-	0xbc, 0xa6, 0xe8, 0x11, 0x34, 0x03, 0x77, 0x8e, 0xe9, 0xc2, 0x9d, 0x60, 0xb3, 0xce, 0x3d, 0xbc,
+	0x96, 0x50, 0x8f, 0xc7, 0x14, 0xdd, 0x87, 0x66, 0xe0, 0x2e, 0x30, 0x5d, 0xba, 0x53, 0x6c, 0xd6,
-	0x39, 0xb0, 0x7f, 0x82, 0x86, 0x32, 0x6e, 0x0f, 0xa0, 0x26, 0x42, 0x43, 0x2d, 0xa8, 0x9f, 0x9d,
+	0x79, 0x84, 0x57, 0x0b, 0xf6, 0x4f, 0xd0, 0x50, 0xce, 0xed, 0x01, 0xd4, 0xc4, 0xd1, 0x50, 0x0b,
-	0x7e, 0x73, 0xfa, 0xf2, 0xbb, 0xd3, 0xce, 0x0a, 0x6a, 0x40, 0xe5, 0x74, 0xff, 0xdb, 0x61, 0xc7,
+	0xea, 0x27, 0xa3, 0x6f, 0x46, 0x2f, 0xbe, 0x1b, 0x75, 0x36, 0x50, 0x03, 0x2a, 0xa3, 0x83, 0x6f,
-	0x40, 0xeb, 0xb0, 0x76, 0xb2, 0x3f, 0x7a, 0x35, 0x76, 0x86, 0x27, 0xc3, 0xfd, 0xd1, 0xf0, 0x45,
+	0x87, 0x9d, 0x12, 0xba, 0x0b, 0x77, 0x8e, 0x0f, 0xc6, 0x2f, 0x27, 0xce, 0xf0, 0x78, 0x78, 0x30,
-	0xa7, 0x64, 0xbf, 0x0b, 0xcd, 0xc4, 0x67, 0x54, 0x87, 0xf2, 0xfe, 0xe8, 0x40, 0x88, 0xbc, 0x18,
+	0x1e, 0x3e, 0xed, 0x94, 0xed, 0x77, 0xa1, 0x99, 0xc4, 0x8c, 0xea, 0x60, 0x1c, 0x8c, 0x0f, 0xc5,
-	0x8e, 0x0e, 0x3a, 0x86, 0xfd, 0xbb, 0x01, 0x5d, 0x3d, 0x45, 0x74, 0x41, 0x02, 0x8a, 0xe3, 0x1c,
+	0x96, 0xa7, 0xc3, 0xf1, 0x61, 0xa7, 0x64, 0xff, 0x56, 0x82, 0xae, 0x4e, 0x11, 0x5d, 0x92, 0x80,
-	0x4d, 0x48, 0x14, 0x24, 0x39, 0xe2, 0x1b, 0x84, 0xa0, 0x12, 0xe0, 0xb7, 0x2a, 0x43, 0x7c, 0x1d,
+	0xe2, 0x98, 0xa3, 0x29, 0x89, 0x82, 0x84, 0x23, 0x3e, 0x41, 0x08, 0x2a, 0x01, 0x7e, 0xa3, 0x18,
-	0x73, 0x32, 0xc2, 0x5c, 0x9f, 0x67, 0xa7, 0xec, 0x88, 0x0d, 0xfa, 0x14, 0x1a, 0x32, 0x74, 0x6a,
+	0xe2, 0xe3, 0x58, 0x93, 0x11, 0xe6, 0xfa, 0x9c, 0x1d, 0xc3, 0x11, 0x13, 0xf4, 0x29, 0x34, 0xe4,
-	0x56, 0x76, 0xcb, 0xbd, 0xd6, 0x60, 0x53, 0x07, 0x44, 0x5a, 0x74, 0x12, 0x36, 0xfb, 0x10, 0xb6,
+	0xd1, 0xa9, 0x59, 0xd9, 0x33, 0x7a, 0xad, 0xc1, 0xb6, 0x0e, 0x88, 0xf4, 0xe8, 0x24, 0x6a, 0xf6,
-	0x0f, 0xb1, 0xf2, 0x44, 0xe0, 0xa5, 0x2a, 0x26, 0xb6, 0xeb, 0xce, 0x31, 0x77, 0x26, 0xb6, 0xeb,
+	0x11, 0xec, 0x1e, 0x61, 0x15, 0x89, 0xc0, 0x4b, 0xdd, 0x98, 0xd8, 0xaf, 0xbb, 0xc0, 0x3c, 0x98,
-	0xce, 0x31, 0x32, 0xa1, 0x2e, 0xcb, 0x8d, 0xbb, 0x53, 0x75, 0xd4, 0xd6, 0x66, 0x60, 0xde, 0x56,
+	0xd8, 0xaf, 0xbb, 0xc0, 0xc8, 0x84, 0xba, 0xbc, 0x6e, 0x3c, 0x9c, 0xaa, 0xa3, 0xa6, 0x36, 0x03,
-	0x24, 0xe3, 0xca, 0xd2, 0xf4, 0x21, 0x54, 0xe2, 0x9b, 0xc0, 0xd5, 0xb4, 0x06, 0x48, 0xf7, 0xf3,
+	0xf3, 0xba, 0x21, 0x79, 0xae, 0x2c, 0x4b, 0x1f, 0x42, 0x25, 0xce, 0x04, 0x6e, 0xa6, 0x35, 0x40,
-	0x38, 0x98, 0x11, 0x87, 0xd3, 0xf5, 0x54, 0x95, 0x97, 0x53, 0x75, 0x94, 0xb6, 0x7a, 0x40, 0x02,
+	0x7a, 0x9c, 0xcf, 0x83, 0x39, 0x71, 0xb8, 0x5c, 0xa7, 0xca, 0x58, 0xa5, 0xea, 0x59, 0xda, 0xeb,
-	0x86, 0x03, 0xf6, 0x30, 0xff, 0x4f, 0x60, 0x27, 0x43, 0x93, 0x0c, 0x60, 0x0f, 0xea, 0xd2, 0x35,
+	0x21, 0x09, 0x18, 0x0e, 0xd8, 0x7a, 0xf1, 0x1f, 0xc3, 0xbd, 0x0c, 0x4b, 0xf2, 0x00, 0xfb, 0x50,
-	0xae, 0x2d, 0x17, 0x57, 0xc5, 0x65, 0xff, 0x5d, 0x82, 0xee, 0xd9, 0x62, 0xea, 0x32, 0xac, 0x48,
+	0x97, 0xa1, 0x71, 0x6b, 0xb9, 0xb8, 0x2a, 0x2d, 0xfb, 0x77, 0x03, 0xba, 0x27, 0xcb, 0x99, 0xcb,
-	0x77, 0x38, 0xf5, 0x18, 0xaa, 0xbc, 0xa3, 0x48, 0x2c, 0xd6, 0x85, 0x6e, 0xd1, 0x76, 0x0e, 0xe2,
+	0xb0, 0x12, 0xdd, 0x10, 0xd4, 0x03, 0xa8, 0xf2, 0x8a, 0x22, 0xb1, 0xb8, 0x2b, 0x6c, 0x8b, 0xb2,
-	0x5f, 0x47, 0xd0, 0xd1, 0x53, 0xa8, 0x5d, 0xb9, 0x7e, 0x84, 0x29, 0x07, 0x22, 0x41, 0x4d, 0x72,
+	0x73, 0x18, 0xff, 0x3a, 0x42, 0x8e, 0x1e, 0x41, 0xed, 0xc2, 0xf5, 0x23, 0x4c, 0x39, 0x10, 0x09,
-	0xf2, 0x76, 0xe4, 0x48, 0x0e, 0xb4, 0x0d, 0xf5, 0x69, 0x78, 0x1d, 0xf7, 0x13, 0x7e, 0x05, 0x1b,
+	0x6a, 0x52, 0x93, 0x97, 0x23, 0x47, 0x6a, 0xa0, 0x5d, 0xa8, 0xcf, 0xc2, 0xcb, 0xb8, 0x9e, 0xf0,
-	0x4e, 0x6d, 0x1a, 0x5e, 0x3b, 0x51, 0x80, 0xde, 0x87, 0xb5, 0xa9, 0x47, 0xdd, 0x73, 0x1f, 0x8f,
+	0x14, 0x6c, 0x38, 0xb5, 0x59, 0x78, 0xe9, 0x44, 0x01, 0x7a, 0x1f, 0xee, 0xcc, 0x3c, 0xea, 0x9e,
-	0x2f, 0x09, 0x79, 0x43, 0xf9, 0x2d, 0x6c, 0x38, 0xab, 0xf2, 0xf0, 0x28, 0x3e, 0x43, 0x56, 0x5c,
+	0xfa, 0x78, 0x72, 0x4e, 0xc8, 0x6b, 0xca, 0xb3, 0xb0, 0xe1, 0x6c, 0xca, 0xc5, 0x67, 0xf1, 0x1a,
-	0x49, 0x93, 0x10, 0xbb, 0x0c, 0x9b, 0x35, 0x4e, 0x4f, 0xf6, 0x31, 0x86, 0xcc, 0x9b, 0x63, 0x12,
+	0xb2, 0xe2, 0x9b, 0x34, 0x0d, 0xb1, 0xcb, 0xb0, 0x59, 0xe3, 0xf2, 0x64, 0x1e, 0x63, 0xc8, 0xbc,
-	0x31, 0x7e, 0x75, 0xca, 0x8e, 0xda, 0xa2, 0xf7, 0x60, 0x35, 0xc4, 0x14, 0xb3, 0xb1, 0xf4, 0xb2,
+	0x05, 0x26, 0x11, 0xe3, 0xa9, 0x63, 0x38, 0x6a, 0x8a, 0xde, 0x83, 0xcd, 0x10, 0x53, 0xcc, 0x26,
-	0xc1, 0x25, 0x5b, 0xfc, 0xec, 0xb5, 0x70, 0x0b, 0x41, 0xe5, 0x57, 0xd7, 0x63, 0x66, 0x93, 0x93,
+	0x32, 0xca, 0x06, 0xdf, 0xd9, 0xe2, 0x6b, 0xaf, 0x44, 0x58, 0x08, 0x2a, 0xbf, 0xba, 0x1e, 0x33,
-	0xf8, 0x5a, 0x88, 0x45, 0x14, 0x2b, 0x31, 0x50, 0x62, 0x11, 0xc5, 0x52, 0xac, 0x0b, 0xd5, 0x19,
+	0x9b, 0x5c, 0xc4, 0xc7, 0x62, 0x5b, 0x44, 0xb1, 0xda, 0x06, 0x6a, 0x5b, 0x44, 0xb1, 0xdc, 0xd6,
-	0x09, 0x27, 0xd8, 0x6c, 0x71, 0x9a, 0xd8, 0xd8, 0x47, 0xb0, 0xb9, 0x04, 0xf2, 0x43, 0xf3, 0xf5,
+	0x85, 0xea, 0x9c, 0x84, 0x53, 0x6c, 0xb6, 0xb8, 0x4c, 0x4c, 0xd0, 0x00, 0xb6, 0x43, 0x4c, 0x59,
-	0x8f, 0x01, 0x5b, 0x0e, 0xf1, 0xfd, 0x73, 0x77, 0xf2, 0xa6, 0x40, 0xc6, 0x52, 0xe0, 0x96, 0xee,
+	0xe8, 0x4d, 0xd9, 0x84, 0x91, 0xc9, 0xd5, 0x3d, 0xd9, 0xe4, 0x5a, 0x5b, 0x4a, 0xf8, 0x92, 0x8c,
-	0x06, 0xb7, 0x9c, 0x01, 0x6e, 0xaa, 0x08, 0x2b, 0x5a, 0x11, 0x6a, 0xb0, 0x57, 0xf3, 0x61, 0xaf,
+	0x52, 0x37, 0x66, 0x7b, 0x85, 0x98, 0x75, 0x39, 0xfe, 0xa3, 0x0c, 0x3b, 0x0e, 0xf1, 0xfd, 0x53,
-	0xe9, 0xb0, 0x2b, 0x4c, 0xeb, 0x29, 0x4c, 0x13, 0xc0, 0x1a, 0x69, 0xc0, 0xbe, 0x86, 0xed, 0x5b,
+	0x77, 0xfa, 0xba, 0x00, 0xcb, 0x29, 0x42, 0xca, 0x37, 0x13, 0x62, 0x64, 0x10, 0x92, 0xba, 0xb8,
-	0x51, 0x3e, 0x14, 0xb2, 0x3f, 0x4a, 0xb0, 0x79, 0x1c, 0x50, 0xe6, 0xfa, 0xfe, 0x12, 0x62, 0x49,
+	0x15, 0xed, 0xe2, 0x6a, 0x54, 0x55, 0xf3, 0xa9, 0xaa, 0xe9, 0x54, 0x29, 0x1e, 0xea, 0x29, 0x1e,
-	0x3d, 0x1b, 0x85, 0xeb, 0xb9, 0xf4, 0x5f, 0xea, 0xb9, 0xac, 0x41, 0xae, 0xf2, 0x53, 0x49, 0xe5,
+	0x12, 0x90, 0x1b, 0xff, 0x17, 0xe4, 0xaf, 0x61, 0xf7, 0x1a, 0x32, 0xeb, 0xc2, 0xfc, 0x4f, 0x19,
-	0xa7, 0x50, 0x8d, 0x6b, 0x9d, 0xa5, 0xb6, 0xd4, 0x59, 0xd0, 0x3b, 0x00, 0xa2, 0x28, 0xb9, 0x72,
+	0xb6, 0x9f, 0x07, 0x94, 0xb9, 0xbe, 0xbf, 0x82, 0x72, 0x92, 0x37, 0xa5, 0xc2, 0x79, 0x53, 0xfe,
-	0x01, 0x6d, 0x93, 0x9f, 0x9c, 0xca, 0x46, 0xa2, 0xb2, 0xd1, 0xc8, 0xce, 0x46, 0xaa, 0xc2, 0xed,
+	0x2f, 0x79, 0x63, 0x68, 0x34, 0x29, 0x4e, 0x2b, 0x29, 0x4e, 0x0b, 0xe5, 0x92, 0x56, 0xc1, 0x6a,
-	0x63, 0xd8, 0x5a, 0x86, 0xea, 0xa1, 0xb0, 0xff, 0x66, 0xc0, 0xf6, 0x59, 0xe0, 0x65, 0x02, 0x9f,
+	0x2b, 0x15, 0x0c, 0xbd, 0x03, 0x20, 0x2e, 0x3f, 0x37, 0x2e, 0xe8, 0x68, 0xf2, 0x95, 0x91, 0x2c,
-	0x55, 0xaa, 0xb7, 0xa0, 0x28, 0x65, 0x40, 0xd1, 0x85, 0xea, 0x22, 0x0a, 0x2f, 0xb0, 0x84, 0x56,
+	0x58, 0x8a, 0xc1, 0x46, 0x36, 0x83, 0xe9, 0x4c, 0xca, 0xe5, 0x0a, 0xf2, 0xb9, 0x7a, 0x0e, 0x3b,
-	0x6c, 0xd2, 0x31, 0x56, 0xb4, 0x18, 0xed, 0x31, 0x98, 0xb7, 0x7d, 0x78, 0x60, 0x44, 0xb1, 0xd7,
+	0xab, 0xf0, 0xae, 0x4b, 0xd5, 0x9f, 0x25, 0xd8, 0x3d, 0x09, 0xbc, 0x4c, 0xb2, 0xb2, 0x52, 0xe2,
-	0xc9, 0x4b, 0xd0, 0x14, 0x5d, 0xdf, 0xde, 0x80, 0xf5, 0x43, 0xcc, 0x5e, 0x8b, 0x6b, 0x21, 0xc3,
+	0x1a, 0x7c, 0xe5, 0x0c, 0xf8, 0xba, 0x50, 0x5d, 0x46, 0xe1, 0x19, 0x96, 0x74, 0x88, 0x49, 0x1a,
-	0xb3, 0x87, 0x80, 0xd2, 0x87, 0x37, 0xf6, 0xe4, 0x91, 0x6e, 0x4f, 0x8d, 0x45, 0x8a, 0x5f, 0x71,
+	0x97, 0x8a, 0x8e, 0xcb, 0x3a, 0xf7, 0x75, 0x02, 0xe6, 0xf5, 0xb8, 0xd7, 0x44, 0x21, 0x3e, 0x69,
-	0xd9, 0x5f, 0x70, 0xdd, 0x47, 0x1e, 0x65, 0x24, 0xbc, 0xbe, 0x0b, 0xba, 0x0e, 0x94, 0xe7, 0xee,
+	0xf2, 0xb2, 0x35, 0xc5, 0x2b, 0x66, 0x6f, 0xc1, 0xdd, 0x23, 0xcc, 0x5e, 0x89, 0x94, 0x95, 0x90,
-	0x5b, 0xf9, 0x50, 0xc4, 0x4b, 0xfb, 0x90, 0x7b, 0x90, 0x88, 0x4a, 0x0f, 0xd2, 0xcf, 0xae, 0x51,
+	0xd8, 0x43, 0x40, 0xe9, 0xc5, 0x2b, 0x7f, 0x72, 0x49, 0xf7, 0xa7, 0xda, 0x3c, 0xa5, 0x9f, 0xbc,
-	0xec, 0xd9, 0xfd, 0x01, 0xd0, 0x2b, 0x9c, 0x4c, 0x00, 0xf7, 0xbc, 0x58, 0x2a, 0x09, 0x25, 0xbd,
+	0x5c, 0x5f, 0x70, 0xdb, 0xcf, 0x3c, 0xca, 0x48, 0x78, 0x79, 0x13, 0xdc, 0x1d, 0x30, 0x16, 0xee,
-	0xd0, 0x4c, 0xa8, 0x4f, 0x7c, 0xec, 0x06, 0xd1, 0x42, 0xa6, 0x4d, 0x6d, 0xed, 0x1f, 0x61, 0x43,
+	0x1b, 0xf9, 0xf0, 0xc5, 0x43, 0xfb, 0x88, 0x47, 0x90, 0x6c, 0x95, 0x11, 0xa4, 0xdb, 0x88, 0x52,
-	0xd3, 0x2e, 0xfd, 0x8c, 0xe3, 0xa1, 0x17, 0x52, 0x7b, 0xbc, 0x44, 0x9f, 0x43, 0x4d, 0x8c, 0x45,
+	0xb1, 0x36, 0xe2, 0x07, 0x40, 0x2f, 0x71, 0xd2, 0xd1, 0xdc, 0xf2, 0x02, 0x2b, 0xe2, 0xca, 0x3a,
-	0x5c, 0x77, 0x7b, 0xf0, 0x48, 0xf7, 0x9b, 0x2b, 0x89, 0x02, 0x39, 0x47, 0x39, 0x92, 0x77, 0xf0,
+	0x71, 0x26, 0xd4, 0xa7, 0x3e, 0x76, 0x83, 0x68, 0x29, 0xa9, 0x56, 0x53, 0xfb, 0x47, 0xd8, 0xd2,
-	0x57, 0x03, 0xda, 0xea, 0xa1, 0x17, 0x43, 0x1b, 0xf2, 0x60, 0x35, 0x3d, 0xd1, 0xa0, 0x27, 0xf9,
+	0xac, 0xcb, 0x38, 0xe3, 0xf3, 0xd0, 0x33, 0x69, 0x3d, 0x1e, 0xa2, 0xcf, 0xa1, 0x26, 0xda, 0x3c,
-	0x33, 0xdd, 0xd2, 0x60, 0x6a, 0x3d, 0x2d, 0xc2, 0x2a, 0x22, 0xb0, 0x57, 0x3e, 0x31, 0x10, 0x85,
+	0x6e, 0xbb, 0x3d, 0xb8, 0xaf, 0xc7, 0xcd, 0x8d, 0x44, 0x81, 0xec, 0x0b, 0x1d, 0xa9, 0x3b, 0xf8,
-	0xce, 0xf2, 0xa0, 0x81, 0x9e, 0x65, 0xeb, 0xc8, 0x99, 0x6c, 0xac, 0x7e, 0x51, 0x76, 0x65, 0x16,
+	0xbb, 0x01, 0x6d, 0xd5, 0xb8, 0x88, 0x26, 0x14, 0x79, 0xb0, 0x99, 0xee, 0xd0, 0xd0, 0xc3, 0xfc,
-	0x5d, 0xf1, 0x9a, 0xd1, 0xa7, 0x03, 0x74, 0xaf, 0x1a, 0x7d, 0x20, 0xb1, 0xf6, 0x0a, 0xf3, 0x27,
+	0x1e, 0x75, 0xa5, 0xd1, 0xb6, 0x1e, 0x15, 0x51, 0x15, 0x27, 0xb0, 0x37, 0x3e, 0x29, 0x21, 0x0a,
-	0x76, 0x7f, 0x86, 0x35, 0xed, 0x85, 0x43, 0x39, 0x68, 0x65, 0xcd, 0x1a, 0xd6, 0x47, 0x85, 0x78,
+	0x9d, 0xd5, 0xc6, 0x09, 0x3d, 0xce, 0xb6, 0x91, 0xd3, 0xa9, 0x59, 0xfd, 0xa2, 0xea, 0xca, 0x2d,
-	0x13, 0x5b, 0x73, 0x68, 0xeb, 0x4d, 0x0a, 0xe5, 0x28, 0xc8, 0xec, 0xfa, 0xd6, 0xc7, 0xc5, 0x98,
+	0xba, 0xe0, 0x77, 0x46, 0xef, 0x76, 0xd0, 0xad, 0x66, 0xf4, 0x06, 0xcb, 0xda, 0x2f, 0xac, 0x9f,
-	0x13, 0x73, 0x14, 0x3a, 0xcb, 0x3d, 0x24, 0x2f, 0x8f, 0x39, 0xfd, 0x2e, 0x2f, 0x8f, 0x79, 0xad,
+	0xf8, 0xfd, 0x19, 0xee, 0x68, 0xaf, 0x2f, 0xca, 0x41, 0x2b, 0xab, 0x77, 0xb2, 0x3e, 0x2a, 0xa4,
-	0xc9, 0x5e, 0x41, 0x2e, 0xc0, 0x4d, 0x0b, 0x41, 0x8f, 0x73, 0x13, 0xa2, 0x77, 0x1e, 0xab, 0x77,
+	0x9b, 0xf8, 0x5a, 0x40, 0x5b, 0x2f, 0x6c, 0x28, 0xc7, 0x40, 0xe6, 0xeb, 0x62, 0x7d, 0x5c, 0x4c,
-	0x3f, 0x63, 0x62, 0x62, 0x01, 0xff, 0x5b, 0x7a, 0x63, 0x51, 0x0e, 0x34, 0xd9, 0x03, 0x87, 0xf5,
+	0x39, 0x71, 0x47, 0xa1, 0xb3, 0x5a, 0x43, 0xf2, 0x78, 0xcc, 0xa9, 0x91, 0x79, 0x3c, 0xe6, 0x95,
-	0xac, 0x20, 0xf7, 0x52, 0x50, 0xb2, 0x2b, 0xdd, 0x11, 0x94, 0xde, 0xf2, 0xee, 0x08, 0x6a, 0xa9,
+	0x26, 0x7b, 0x03, 0xb9, 0x00, 0x57, 0x25, 0x04, 0x3d, 0xc8, 0x25, 0x44, 0xaf, 0x3c, 0x56, 0xef,
-	0xc1, 0xd9, 0x2b, 0xc8, 0x83, 0xb6, 0x13, 0x05, 0xd2, 0x74, 0xdc, 0x16, 0x50, 0x8e, 0xf4, 0xed,
+	0x76, 0xc5, 0xc4, 0xc5, 0x12, 0xde, 0x5a, 0x79, 0xcb, 0x51, 0x0e, 0x34, 0xd9, 0xcd, 0x90, 0xf5,
-	0xae, 0x66, 0x3d, 0x29, 0xc0, 0x79, 0x73, 0xbf, 0x9f, 0xc3, 0xf7, 0x0d, 0xc5, 0x7a, 0x5e, 0xe3,
+	0xb8, 0xa0, 0xf6, 0xca, 0xa1, 0x64, 0x55, 0xba, 0xe1, 0x50, 0x7a, 0xc9, 0xbb, 0xe1, 0x50, 0x2b,
-	0xff, 0x69, 0x3f, 0xfb, 0x37, 0x00, 0x00, 0xff, 0xff, 0xf3, 0x7c, 0x9c, 0x49, 0xc1, 0x0f, 0x00,
+	0x05, 0xce, 0xde, 0x40, 0x1e, 0xb4, 0x9d, 0x28, 0x90, 0xae, 0xe3, 0xb2, 0x80, 0x72, 0x76, 0x5f,
-	0x00,
+	0xaf, 0x6a, 0xd6, 0xc3, 0x02, 0x9a, 0x57, 0xf9, 0xfd, 0x04, 0xbe, 0x6f, 0x28, 0xd5, 0xd3, 0x1a,
+	0xff, 0x8f, 0xfe, 0xd9, 0xbf, 0x01, 0x00, 0x00, 0xff, 0xff, 0x0b, 0x9b, 0x0f, 0xae, 0x91, 0x10,
+	0x00, 0x00,
 }

pkg/proto/hapi/version/version.pb.go

@@ -1,5 +1,6 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
+// Code generated by protoc-gen-go.
 // source: hapi/version/version.proto
+// DO NOT EDIT!
 
 /*
 Package version is a generated protocol buffer package.
@@ -39,27 +40,6 @@ func (m *Version) String() string            { return proto.CompactTextString(m)
 func (*Version) ProtoMessage()               {}
 func (*Version) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0} }
 
-func (m *Version) GetSemVer() string {
-	if m != nil {
-		return m.SemVer
-	}
-	return ""
-}
-
-func (m *Version) GetGitCommit() string {
-	if m != nil {
-		return m.GitCommit
-	}
-	return ""
-}
-
-func (m *Version) GetGitTreeState() string {
-	if m != nil {
-		return m.GitTreeState
-	}
-	return ""
-}
-
 func init() {
 	proto.RegisterType((*Version)(nil), "hapi.version.Version")
 }

pkg/releasetesting/environment.go

@@ -39,7 +39,7 @@ type Environment struct {
 
 func (env *Environment) createTestPod(test *test) error {
 	b := bytes.NewBufferString(test.manifest)
-	if err := env.KubeClient.Create(env.Namespace, b, env.Timeout, false); err != nil {
+	if err := env.KubeClient.Create(env.Namespace, b, env.Timeout, false, true); err != nil {
 		log.Printf(err.Error())
 		test.result.Info = err.Error()
 		test.result.Status = release.TestRun_FAILURE
@@ -51,7 +51,7 @@ func (env *Environment) createTestPod(test *test) error {
 
 func (env *Environment) getTestPodStatus(test *test) (api.PodPhase, error) {
 	b := bytes.NewBufferString(test.manifest)
-	status, err := env.KubeClient.WaitAndGetCompletedPodPhase(env.Namespace, b, time.Duration(env.Timeout)*time.Second)
+	status, err := env.KubeClient.WaitAndGetCompletedPodPhase(env.Namespace, b, time.Duration(env.Timeout)*time.Second, true)
 	if err != nil {
 		log.Printf("Error getting status for pod %s: %s", test.result.Name, err)
 		test.result.Info = err.Error()
@@ -114,7 +114,7 @@ func (env *Environment) streamMessage(msg string, status release.TestRun_Status)
 // DeleteTestPods deletes resources given in testManifests
 func (env *Environment) DeleteTestPods(testManifests []string) {
 	for _, testManifest := range testManifests {
-		err := env.KubeClient.Delete(env.Namespace, bytes.NewBufferString(testManifest))
+		err := env.KubeClient.Delete(env.Namespace, true, bytes.NewBufferString(testManifest))
 		if err != nil {
 			env.streamError(err.Error())
 		}

pkg/releasetesting/environment_test.go

@@ -70,7 +70,7 @@ func TestDeleteTestPods(t *testing.T) {
 	}
 
 	for _, testManifest := range mockTestSuite.TestManifests {
-		if _, err := mockTestEnv.KubeClient.Get(mockTestEnv.Namespace, bytes.NewBufferString(testManifest)); err == nil {
+		if _, err := mockTestEnv.KubeClient.Get(mockTestEnv.Namespace, true, bytes.NewBufferString(testManifest)); err == nil {
 			t.Error("Expected error, got nil")
 		}
 	}
@@ -149,7 +149,7 @@ func newGetFailingKubeClient() *getFailingKubeClient {
 	}
 }
 
-func (p *getFailingKubeClient) Get(ns string, r io.Reader) (string, error) {
+func (p *getFailingKubeClient) Get(ns string, restrictNs bool, r io.Reader) (string, error) {
 	return "", errors.New("in the end, they did not find Nemo")
 }
 
@@ -163,7 +163,7 @@ func newDeleteFailingKubeClient() *deleteFailingKubeClient {
 	}
 }
 
-func (p *deleteFailingKubeClient) Delete(ns string, r io.Reader) error {
+func (p *deleteFailingKubeClient) Delete(ns string, restrictNs bool, r io.Reader) error {
 	return errors.New("delete failed")
 }
 
@@ -177,6 +177,6 @@ func newCreateFailingKubeClient() *createFailingKubeClient {
 	}
 }
 
-func (p *createFailingKubeClient) Create(ns string, r io.Reader, t int64, shouldWait bool) error {
+func (p *createFailingKubeClient) Create(ns string, r io.Reader, t int64, shouldWait, restrictNs bool) error {
 	return errors.New("We ran out of budget and couldn't create finding-nemo")
 }

pkg/releasetesting/test_suite_test.go

@@ -324,7 +324,7 @@ func newPodSucceededKubeClient() *podSucceededKubeClient {
 	}
 }
 
-func (p *podSucceededKubeClient) WaitAndGetCompletedPodPhase(ns string, r io.Reader, timeout time.Duration) (api.PodPhase, error) {
+func (p *podSucceededKubeClient) WaitAndGetCompletedPodPhase(ns string, r io.Reader, timeout time.Duration, restrictNs bool) (api.PodPhase, error) {
 	return api.PodSucceeded, nil
 }
 
@@ -338,6 +338,6 @@ func newPodFailedKubeClient() *podFailedKubeClient {
 	}
 }
 
-func (p *podFailedKubeClient) WaitAndGetCompletedPodPhase(ns string, r io.Reader, timeout time.Duration) (api.PodPhase, error) {
+func (p *podFailedKubeClient) WaitAndGetCompletedPodPhase(ns string, r io.Reader, timeout time.Duration, restrictNs bool) (api.PodPhase, error) {
 	return api.PodFailed, nil
 }

pkg/tiller/environment/environment.go

@@ -102,31 +102,37 @@ type KubeClient interface {
 	//
 	// reader must contain a YAML stream (one or more YAML documents separated
 	// by "\n---\n").
-	Create(namespace string, reader io.Reader, timeout int64, shouldWait bool) error
+	Create(namespace string, reader io.Reader, timeout int64, shouldWait, restrictNs bool) error
 
 	// Get gets one or more resources. Returned string hsa the format like kubectl
 	// provides with the column headers separating the resource types.
 	//
 	// namespace must contain a valid existing namespace.
 	//
+	// restrictNs generates an error if reader contains objects
+	// outside namespace.
+	//
 	// reader must contain a YAML stream (one or more YAML documents separated
 	// by "\n---\n").
-	Get(namespace string, reader io.Reader) (string, error)
+	Get(namespace string, restrictNs bool, reader io.Reader) (string, error)
 
 	// Delete destroys one or more resources.
 	//
 	// namespace must contain a valid existing namespace.
 	//
+	// restrictNs generates an error if reader contains objects
+	// outside namespace.
+	//
 	// reader must contain a YAML stream (one or more YAML documents separated
 	// by "\n---\n").
-	Delete(namespace string, reader io.Reader) error
+	Delete(namespace string, restrictNs bool, reader io.Reader) error
 
 	// Watch the resource in reader until it is "ready".
 	//
 	// For Jobs, "ready" means the job ran to completion (excited without error).
 	// For all other kinds, it means the kind was created or modified without
 	// error.
-	WatchUntilReady(namespace string, reader io.Reader, timeout int64, shouldWait bool) error
+	WatchUntilReady(namespace string, reader io.Reader, timeout int64, shouldWait, restrictNs bool) error
 
 	// Update updates one or more resources or creates the resource
 	// if it doesn't exist.
@@ -135,14 +141,14 @@ type KubeClient interface {
 	//
 	// reader must contain a YAML stream (one or more YAML documents separated
 	// by "\n---\n").
-	Update(namespace string, originalReader, modifiedReader io.Reader, force bool, recreate bool, timeout int64, shouldWait bool) error
+	Update(namespace string, originalReader, modifiedReader io.Reader, force bool, recreate bool, timeout int64, shouldWait, restrictNs bool) error
 
-	Build(namespace string, reader io.Reader) (kube.Result, error)
+	Build(namespace string, restrictNs bool, reader io.Reader) (kube.Result, error)
-	BuildUnstructured(namespace string, reader io.Reader) (kube.Result, error)
+	BuildUnstructured(namespace string, restrictNs bool, reader io.Reader) (kube.Result, error)
 
 	// WaitAndGetCompletedPodPhase waits up to a timeout until a pod enters a completed phase
 	// and returns said phase (PodSucceeded or PodFailed qualify).
-	WaitAndGetCompletedPodPhase(namespace string, reader io.Reader, timeout time.Duration) (api.PodPhase, error)
+	WaitAndGetCompletedPodPhase(namespace string, reader io.Reader, timeout time.Duration, restrictNs bool) (api.PodPhase, error)
 }
 
 // PrintingKubeClient implements KubeClient, but simply prints the reader to
@@ -152,13 +158,13 @@ type PrintingKubeClient struct {
 }
 
 // Create prints the values of what would be created with a real KubeClient.
-func (p *PrintingKubeClient) Create(ns string, r io.Reader, timeout int64, shouldWait bool) error {
+func (p *PrintingKubeClient) Create(ns string, r io.Reader, timeout int64, shouldWait, restrictNs bool) error {
 	_, err := io.Copy(p.Out, r)
 	return err
 }
 
 // Get prints the values of what would be created with a real KubeClient.
-func (p *PrintingKubeClient) Get(ns string, r io.Reader) (string, error) {
+func (p *PrintingKubeClient) Get(ns string, restrictNs bool, r io.Reader) (string, error) {
 	_, err := io.Copy(p.Out, r)
 	return "", err
 }
@@ -166,35 +172,35 @@ func (p *PrintingKubeClient) Get(ns string, r io.Reader) (string, error) {
 // Delete implements KubeClient delete.
 //
 // It only prints out the content to be deleted.
-func (p *PrintingKubeClient) Delete(ns string, r io.Reader) error {
+func (p *PrintingKubeClient) Delete(ns string, restrictNs bool, r io.Reader) error {
 	_, err := io.Copy(p.Out, r)
 	return err
 }
 
 // WatchUntilReady implements KubeClient WatchUntilReady.
-func (p *PrintingKubeClient) WatchUntilReady(ns string, r io.Reader, timeout int64, shouldWait bool) error {
+func (p *PrintingKubeClient) WatchUntilReady(ns string, r io.Reader, timeout int64, shouldWait, restrictNs bool) error {
 	_, err := io.Copy(p.Out, r)
 	return err
 }
 
 // Update implements KubeClient Update.
-func (p *PrintingKubeClient) Update(ns string, currentReader, modifiedReader io.Reader, force bool, recreate bool, timeout int64, shouldWait bool) error {
+func (p *PrintingKubeClient) Update(ns string, currentReader, modifiedReader io.Reader, force bool, recreate bool, timeout int64, shouldWait, restrictNs bool) error {
 	_, err := io.Copy(p.Out, modifiedReader)
 	return err
 }
 
 // Build implements KubeClient Build.
-func (p *PrintingKubeClient) Build(ns string, reader io.Reader) (kube.Result, error) {
+func (p *PrintingKubeClient) Build(ns string, restrictNs bool, reader io.Reader) (kube.Result, error) {
 	return []*resource.Info{}, nil
 }
 
 // BuildUnstructured implements KubeClient BuildUnstructured.
-func (p *PrintingKubeClient) BuildUnstructured(ns string, reader io.Reader) (kube.Result, error) {
+func (p *PrintingKubeClient) BuildUnstructured(ns string, restrictNs bool, reader io.Reader) (kube.Result, error) {
 	return []*resource.Info{}, nil
 }
 
 // WaitAndGetCompletedPodPhase implements KubeClient WaitAndGetCompletedPodPhase.
-func (p *PrintingKubeClient) WaitAndGetCompletedPodPhase(namespace string, reader io.Reader, timeout time.Duration) (api.PodPhase, error) {
+func (p *PrintingKubeClient) WaitAndGetCompletedPodPhase(namespace string, reader io.Reader, timeout time.Duration, restrictNs bool) (api.PodPhase, error) {
 	_, err := io.Copy(p.Out, reader)
 	return api.PodUnknown, err
 }

pkg/tiller/environment/environment_test.go

@@ -40,32 +40,32 @@ func (e *mockEngine) Render(chrt *chart.Chart, v chartutil.Values) (map[string]s
 
 type mockKubeClient struct{}
 
-func (k *mockKubeClient) Create(ns string, r io.Reader, timeout int64, shouldWait bool) error {
+func (k *mockKubeClient) Create(ns string, r io.Reader, timeout int64, shouldWait, restrictNs bool) error {
 	return nil
 }
-func (k *mockKubeClient) Get(ns string, r io.Reader) (string, error) {
+func (k *mockKubeClient) Get(ns string, restrictNs bool, r io.Reader) (string, error) {
 	return "", nil
 }
-func (k *mockKubeClient) Delete(ns string, r io.Reader) error {
+func (k *mockKubeClient) Delete(ns string, restrictNs bool, r io.Reader) error {
 	return nil
 }
-func (k *mockKubeClient) Update(ns string, currentReader, modifiedReader io.Reader, force bool, recreate bool, timeout int64, shouldWait bool) error {
+func (k *mockKubeClient) Update(ns string, currentReader, modifiedReader io.Reader, force bool, recreate bool, timeout int64, shouldWait, restrictNs bool) error {
 	return nil
 }
-func (k *mockKubeClient) WatchUntilReady(ns string, r io.Reader, timeout int64, shouldWait bool) error {
+func (k *mockKubeClient) WatchUntilReady(ns string, r io.Reader, timeout int64, shouldWait, restrictNs bool) error {
 	return nil
 }
-func (k *mockKubeClient) Build(ns string, reader io.Reader) (kube.Result, error) {
+func (k *mockKubeClient) Build(ns string, restrictNs bool, reader io.Reader) (kube.Result, error) {
 	return []*resource.Info{}, nil
 }
-func (k *mockKubeClient) BuildUnstructured(ns string, reader io.Reader) (kube.Result, error) {
+func (k *mockKubeClient) BuildUnstructured(ns string, restrictNs bool, reader io.Reader) (kube.Result, error) {
 	return []*resource.Info{}, nil
 }
-func (k *mockKubeClient) WaitAndGetCompletedPodPhase(namespace string, reader io.Reader, timeout time.Duration) (api.PodPhase, error) {
+func (k *mockKubeClient) WaitAndGetCompletedPodPhase(namespace string, reader io.Reader, timeout time.Duration, restrictNs bool) (api.PodPhase, error) {
 	return api.PodUnknown, nil
 }
 
-func (k *mockKubeClient) WaitAndGetCompletedPodStatus(namespace string, reader io.Reader, timeout time.Duration) (api.PodPhase, error) {
+func (k *mockKubeClient) WaitAndGetCompletedPodStatus(namespace string, reader io.Reader, timeout time.Duration, restrictNs bool) (api.PodPhase, error) {
 	return "", nil
 }
 
@@ -104,7 +104,7 @@ func TestKubeClient(t *testing.T) {
 		b.WriteString(content)
 	}
 
-	if err := env.KubeClient.Create("sharry-bobbins", b, 300, false); err != nil {
+	if err := env.KubeClient.Create("sharry-bobbins", b, 300, false, true); err != nil {
 		t.Errorf("Kubeclient failed: %s", err)
 	}
 }

pkg/tiller/release_install.go

@@ -127,7 +127,7 @@ func (s *ReleaseServer) prepareRelease(req *services.InstallReleaseRequest) (*re
 		rel.Info.Status.Notes = notesTxt
 	}
 
-	err = validateManifest(s.env.KubeClient, req.Namespace, manifestDoc.Bytes())
+	err = validateManifest(s.env.KubeClient, req.Namespace, req.RestrictToNamespace, manifestDoc.Bytes())
 	return rel, err
 }
 
@@ -143,7 +143,7 @@ func (s *ReleaseServer) performRelease(r *release.Release, req *services.Install
 
 	// pre-install hooks
 	if !req.DisableHooks {
-		if err := s.execHook(r.Hooks, r.Name, r.Namespace, hooks.PreInstall, req.Timeout); err != nil {
+		if err := s.execHook(r.Hooks, r.Name, r.Namespace, hooks.PreInstall, req.Timeout, req.RestrictToNamespace); err != nil {
 			return res, err
 		}
 	} else {
@@ -168,9 +168,10 @@ func (s *ReleaseServer) performRelease(r *release.Release, req *services.Install
 		// so as to append to the old release's history
 		r.Version = old.Version + 1
 		updateReq := &services.UpdateReleaseRequest{
-			Wait:     req.Wait,
+			Wait:                req.Wait,
-			Recreate: false,
+			Recreate:            false,
-			Timeout:  req.Timeout,
+			Timeout:             req.Timeout,
+			RestrictToNamespace: req.RestrictToNamespace,
 		}
 		s.recordRelease(r, false)
 		if err := s.ReleaseModule.Update(old, r, updateReq, s.env); err != nil {
@@ -200,7 +201,7 @@ func (s *ReleaseServer) performRelease(r *release.Release, req *services.Install
 
 	// post-install hooks
 	if !req.DisableHooks {
-		if err := s.execHook(r.Hooks, r.Name, r.Namespace, hooks.PostInstall, req.Timeout); err != nil {
+		if err := s.execHook(r.Hooks, r.Name, r.Namespace, hooks.PostInstall, req.Timeout, req.RestrictToNamespace); err != nil {
 			msg := fmt.Sprintf("Release %q failed post-install: %s", r.Name, err)
 			s.Log("warning: %s", msg)
 			r.Info.Status.Code = release.Status_FAILED

pkg/tiller/release_modules.go

@@ -52,26 +52,26 @@ type LocalReleaseModule struct {
 // Create creates a release via kubeclient from provided environment
 func (m *LocalReleaseModule) Create(r *release.Release, req *services.InstallReleaseRequest, env *environment.Environment) error {
 	b := bytes.NewBufferString(r.Manifest)
-	return env.KubeClient.Create(r.Namespace, b, req.Timeout, req.Wait)
+	return env.KubeClient.Create(r.Namespace, b, req.Timeout, req.Wait, req.RestrictToNamespace)
 }
 
 // Update performs an update from current to target release
 func (m *LocalReleaseModule) Update(current, target *release.Release, req *services.UpdateReleaseRequest, env *environment.Environment) error {
 	c := bytes.NewBufferString(current.Manifest)
 	t := bytes.NewBufferString(target.Manifest)
-	return env.KubeClient.Update(target.Namespace, c, t, req.Force, req.Recreate, req.Timeout, req.Wait)
+	return env.KubeClient.Update(target.Namespace, c, t, req.Force, req.Recreate, req.Timeout, req.Wait, req.RestrictToNamespace)
 }
 
 // Rollback performs a rollback from current to target release
 func (m *LocalReleaseModule) Rollback(current, target *release.Release, req *services.RollbackReleaseRequest, env *environment.Environment) error {
 	c := bytes.NewBufferString(current.Manifest)
 	t := bytes.NewBufferString(target.Manifest)
-	return env.KubeClient.Update(target.Namespace, c, t, req.Force, req.Recreate, req.Timeout, req.Wait)
+	return env.KubeClient.Update(target.Namespace, c, t, req.Force, req.Recreate, req.Timeout, req.Wait, req.RestrictToNamespace)
 }
 
 // Status returns kubectl-like formatted status of release objects
 func (m *LocalReleaseModule) Status(r *release.Release, req *services.GetReleaseStatusRequest, env *environment.Environment) (string, error) {
-	return env.KubeClient.Get(r.Namespace, bytes.NewBufferString(r.Manifest))
+	return env.KubeClient.Get(r.Namespace, false, bytes.NewBufferString(r.Manifest))
 }
 
 // Delete deletes the release and returns manifests that were kept in the deletion process
@@ -80,7 +80,7 @@ func (m *LocalReleaseModule) Delete(rel *release.Release, req *services.Uninstal
 	if err != nil {
 		return rel.Manifest, []error{fmt.Errorf("Could not get apiVersions from Kubernetes: %v", err)}
 	}
-	return DeleteRelease(rel, vs, env.KubeClient)
+	return DeleteRelease(rel, vs, env.KubeClient, req.RestrictToNamespace)
 }
 
 // RemoteReleaseModule is a ReleaseModule which calls Rudder service to operate on a release
@@ -148,7 +148,7 @@ func (m *RemoteReleaseModule) Delete(r *release.Release, req *services.Uninstall
 }
 
 // DeleteRelease is a helper that allows Rudder to delete a release without exposing most of Tiller inner functions
-func DeleteRelease(rel *release.Release, vs chartutil.VersionSet, kubeClient environment.KubeClient) (kept string, errs []error) {
+func DeleteRelease(rel *release.Release, vs chartutil.VersionSet, kubeClient environment.KubeClient, restrictNs bool) (kept string, errs []error) {
 	manifests := relutil.SplitManifests(rel.Manifest)
 	_, files, err := sortManifests(manifests, vs, UninstallOrder)
 	if err != nil {
@@ -170,7 +170,7 @@ func DeleteRelease(rel *release.Release, vs chartutil.VersionSet, kubeClient env
 		if b.Len() == 0 {
 			continue
 		}
-		if err := kubeClient.Delete(rel.Namespace, b); err != nil {
+		if err := kubeClient.Delete(rel.Namespace, restrictNs, b); err != nil {
 			log.Printf("uninstall: Failed deletion of %q: %s", rel.Name, err)
 			if err == kube.ErrNoObjectsVisited {
 				// Rewrite the message from "no objects visited"

pkg/tiller/release_rollback.go

@@ -121,7 +121,7 @@ func (s *ReleaseServer) performRollback(currentRelease, targetRelease *release.R
 
 	// pre-rollback hooks
 	if !req.DisableHooks {
-		if err := s.execHook(targetRelease.Hooks, targetRelease.Name, targetRelease.Namespace, hooks.PreRollback, req.Timeout); err != nil {
+		if err := s.execHook(targetRelease.Hooks, targetRelease.Name, targetRelease.Namespace, hooks.PreRollback, req.Timeout, req.RestrictToNamespace); err != nil {
 			return res, err
 		}
 	} else {
@@ -141,7 +141,7 @@ func (s *ReleaseServer) performRollback(currentRelease, targetRelease *release.R
 
 	// post-rollback hooks
 	if !req.DisableHooks {
-		if err := s.execHook(targetRelease.Hooks, targetRelease.Name, targetRelease.Namespace, hooks.PostRollback, req.Timeout); err != nil {
+		if err := s.execHook(targetRelease.Hooks, targetRelease.Name, targetRelease.Namespace, hooks.PostRollback, req.Timeout, req.RestrictToNamespace); err != nil {
 			return res, err
 		}
 	}

pkg/tiller/release_server.go

@@ -317,7 +317,7 @@ func (s *ReleaseServer) recordRelease(r *release.Release, reuse bool) {
 	}
 }
 
-func (s *ReleaseServer) execHook(hs []*release.Hook, name, namespace, hook string, timeout int64) error {
+func (s *ReleaseServer) execHook(hs []*release.Hook, name, namespace, hook string, timeout int64, restrictNs bool) error {
 	kubeCli := s.env.KubeClient
 	code, ok := events[hook]
 	if !ok {
@@ -339,14 +339,14 @@ func (s *ReleaseServer) execHook(hs []*release.Hook, name, namespace, hook strin
 	for _, h := range executingHooks {
 
 		b := bytes.NewBufferString(h.Manifest)
-		if err := kubeCli.Create(namespace, b, timeout, false); err != nil {
+		if err := kubeCli.Create(namespace, b, timeout, false, restrictNs); err != nil {
 			s.Log("warning: Release %s %s %s failed: %s", name, hook, h.Path, err)
 			return err
 		}
 		// No way to rewind a bytes.Buffer()?
 		b.Reset()
 		b.WriteString(h.Manifest)
-		if err := kubeCli.WatchUntilReady(namespace, b, timeout, false); err != nil {
+		if err := kubeCli.WatchUntilReady(namespace, b, timeout, false, restrictNs); err != nil {
 			s.Log("warning: Release %s %s %s could not complete: %s", name, hook, h.Path, err)
 			// If a hook is failed, checkout the annotation of the hook to determine whether the hook should be deleted
 			// under failed condition. If so, then clear the corresponding resource object in the hook
@@ -354,7 +354,7 @@ func (s *ReleaseServer) execHook(hs []*release.Hook, name, namespace, hook strin
 				b.Reset()
 				b.WriteString(h.Manifest)
 				s.Log("deleting %s hook %s for release %s due to %q policy", hook, h.Name, name, hooks.HookFailed)
-				if errHookDelete := kubeCli.Delete(namespace, b); errHookDelete != nil {
+				if errHookDelete := kubeCli.Delete(namespace, restrictNs, b); errHookDelete != nil {
 					s.Log("warning: Release %s %s %S could not be deleted: %s", name, hook, h.Path, errHookDelete)
 					return errHookDelete
 				}
@@ -370,7 +370,7 @@ func (s *ReleaseServer) execHook(hs []*release.Hook, name, namespace, hook strin
 		b := bytes.NewBufferString(h.Manifest)
 		if hookShouldBeDeleted(h, hooks.HookSucceeded) {
 			s.Log("deleting %s hook %s for release %s due to %q policy", hook, h.Name, name, hooks.HookSucceeded)
-			if errHookDelete := kubeCli.Delete(namespace, b); errHookDelete != nil {
+			if errHookDelete := kubeCli.Delete(namespace, restrictNs, b); errHookDelete != nil {
 				s.Log("warning: Release %s %s %S could not be deleted: %s", name, hook, h.Path, errHookDelete)
 				return errHookDelete
 			}
@@ -381,9 +381,9 @@ func (s *ReleaseServer) execHook(hs []*release.Hook, name, namespace, hook strin
 	return nil
 }
 
-func validateManifest(c environment.KubeClient, ns string, manifest []byte) error {
+func validateManifest(c environment.KubeClient, ns string, restrictNs bool, manifest []byte) error {
 	r := bytes.NewReader(manifest)
-	_, err := c.BuildUnstructured(ns, r)
+	_, err := c.BuildUnstructured(ns, restrictNs, r)
 	return err
 }
 

pkg/tiller/release_server_test.go

@@ -306,7 +306,7 @@ type updateFailingKubeClient struct {
 	environment.PrintingKubeClient
 }
 
-func (u *updateFailingKubeClient) Update(namespace string, originalReader, modifiedReader io.Reader, force bool, recreate bool, timeout int64, shouldWait bool) error {
+func (u *updateFailingKubeClient) Update(namespace string, originalReader, modifiedReader io.Reader, force bool, recreate bool, timeout int64, shouldWait, restrictNs bool) error {
 	return errors.New("Failed update in kube client")
 }
 
@@ -320,7 +320,7 @@ type hookFailingKubeClient struct {
 	environment.PrintingKubeClient
 }
 
-func (h *hookFailingKubeClient) WatchUntilReady(ns string, r io.Reader, timeout int64, shouldWait bool) error {
+func (h *hookFailingKubeClient) WatchUntilReady(ns string, r io.Reader, timeout int64, shouldWait, restrictNs bool) error {
 	return errors.New("Failed watch")
 }
 

pkg/tiller/release_uninstall.go

@@ -68,7 +68,7 @@ func (s *ReleaseServer) UninstallRelease(c ctx.Context, req *services.UninstallR
 	res := &services.UninstallReleaseResponse{Release: rel}
 
 	if !req.DisableHooks {
-		if err := s.execHook(rel.Hooks, rel.Name, rel.Namespace, hooks.PreDelete, req.Timeout); err != nil {
+		if err := s.execHook(rel.Hooks, rel.Name, rel.Namespace, hooks.PreDelete, req.Timeout, req.RestrictToNamespace); err != nil {
 			return res, err
 		}
 	} else {
@@ -91,7 +91,7 @@ func (s *ReleaseServer) UninstallRelease(c ctx.Context, req *services.UninstallR
 	}
 
 	if !req.DisableHooks {
-		if err := s.execHook(rel.Hooks, rel.Name, rel.Namespace, hooks.PostDelete, req.Timeout); err != nil {
+		if err := s.execHook(rel.Hooks, rel.Name, rel.Namespace, hooks.PostDelete, req.Timeout, req.RestrictToNamespace); err != nil {
 			es = append(es, err.Error())
 		}
 	}

pkg/tiller/release_update.go

@@ -133,7 +133,7 @@ func (s *ReleaseServer) prepareUpdate(req *services.UpdateReleaseRequest) (*rele
 	if len(notesTxt) > 0 {
 		updatedRelease.Info.Status.Notes = notesTxt
 	}
-	err = validateManifest(s.env.KubeClient, currentRelease.Namespace, manifestDoc.Bytes())
+	err = validateManifest(s.env.KubeClient, currentRelease.Namespace, req.RestrictToNamespace, manifestDoc.Bytes())
 	return currentRelease, updatedRelease, err
 }
 
@@ -148,7 +148,7 @@ func (s *ReleaseServer) performUpdate(originalRelease, updatedRelease *release.R
 
 	// pre-upgrade hooks
 	if !req.DisableHooks {
-		if err := s.execHook(updatedRelease.Hooks, updatedRelease.Name, updatedRelease.Namespace, hooks.PreUpgrade, req.Timeout); err != nil {
+		if err := s.execHook(updatedRelease.Hooks, updatedRelease.Name, updatedRelease.Namespace, hooks.PreUpgrade, req.Timeout, req.RestrictToNamespace); err != nil {
 			return res, err
 		}
 	} else {
@@ -166,7 +166,7 @@ func (s *ReleaseServer) performUpdate(originalRelease, updatedRelease *release.R
 
 	// post-upgrade hooks
 	if !req.DisableHooks {
-		if err := s.execHook(updatedRelease.Hooks, updatedRelease.Name, updatedRelease.Namespace, hooks.PostUpgrade, req.Timeout); err != nil {
+		if err := s.execHook(updatedRelease.Hooks, updatedRelease.Name, updatedRelease.Namespace, hooks.PostUpgrade, req.Timeout, req.RestrictToNamespace); err != nil {
 			return res, err
 		}
 	}