Security Bulletin: IBM InfoSphere Information Server containers are vulnerable to privilege escalation

Perform the following steps to secure your environment:

1. List your kube-system namespace
     > kubectl get deployments -n kube-system
 

2. List the pods in your kube-system namespace
      > kubectl get deployments -n kube-system

3. Delete the tiller pod
     >  kubectl delete deployment tiller-deploy --namespace=kube-system

4. Verify that the tiller pod was deleted by examining the output of command
     > kubectl get deployments -n kube-system

    Verify that helm is working by executing the following command:
     > helm list

    The output should contain the list of deployed services.
    However, if the following error message is displayed:
         Error: configmaps is forbidden: User "system:serviceaccount:kube-system:default" cannot list resource "configmaps" in API group "" in the namespace "kube-system"

         Execute the following command:
         > kubectl patch deploy --namespace kube-system tiller-deploy -p '{"spec":{"template":{"spec":{"serviceAccount":"tiller"}}}}'

        After 10 to 20 seconds, again check the output of "helm list" as indicated above.

NOTE:
After making the above changes, if at a later point in time you need to install a patch, you must deploy the tiller pod before installing the patch. Use the following steps:

1. Deploy tiller
     > /usr/local/bin/helm init

2. Verify that the tiller POD is created by executing the command
     >  kubectl get deployments -n kube-system