Helm V2 Tiller has a known security vulnerability that allows attackers to install unauthorized applications in a cluster. Update to Helm V3 to eliminate this risk.
Impact scope
Run
kubectl get deploy -n kube-system tiller-deploy
to check for a Tiller Deployment. If one exists, verify:
- The cluster kubeconfig is shared with external users.
- External access to the ACK console is allowed.
- The cluster runs in multi-tenancy mode with user privilege isolation.
If any condition is met, update to Helm V3.
Alternative: Update Tiller only
If your cluster is unaffected or you cannot upgrade to Helm V3, update Tiller to the latest version instead.
-
Update Tiller:
helm init --tiller-image registry.cn-hangzhou.aliyuncs.com/acs/tiller:v2.16.3 --upgrade -
After Tiller passes the health check, run helm version to verify the update.
This updates only the Helm server component. Download the client component for your operating system separately.
Note If your cluster is unaffected or Helm V3 upgrade is unavailable, update Tiller and skip the remaining steps. You can upgrade to Helm V3 later.
Precheck
Verify your cluster state before upgrading to Helm V3.
- Run kubectl get deploy -n kube-system tiller-deploy to check whether Tiller is installed.
- If Tiller exists, run helm ls -a to list installed applications.
-
If applications exist, delete them. Helm V2 and V3 data formats are incompatible.
Important The Helm community provides helm-2to3 to migrate V2 configurations and releases to V3. To prevent data loss, use this plug-in with caution.
Procedure
- Complete the Precheck.
- Delete the Tiller Deployment: kubectl delete deploy tiller-deploy -n kube-system.
-
Download the Helm V3 client and reinstall your applications.
ImportantBefore reinstalling applications:
- Helm V2 applications must be reinstalled with Helm V3. Evaluate the impact on your workloads.
- Reinstallation causes data loss. Back up your data first.