<p>Having my cluster up and running on AWS EKS, I'm finding trouble running <code>helm init</code> with the following error:</p>

<pre><code>$ helm init --service-account tiller --upgrade
Error: error installing: deployments.extensions is forbidden: User "system:anonymous" cannot create deployments.extensions in the namespace "kube-system"
</code></pre>

<p><code>kubectl</code> works properly (object retrieval, creation and cluster administration), authenticating and authorizing correctly by running <code>heptio-authenticator-aws</code> at connection time ( with an <code>exec</code> section in the kubectl config).</p>

<p>In order to prepare the cluster for helm, I created the service account and role binding as specified in the helm <a href="https://github.com/kubernetes/helm/blob/master/docs/rbac.md" rel="nofollow noreferrer">docs</a>.</p>

<p>I've heard of people having helm running on EKS, and I'm guessing they're skipping the <code>exec</code> section of the kubectl config by hardcoding the token... I'd like to avoid that!</p>

<p>Any ideas on how to fix this? My guess is that it is related to helm not being able to execute <code>heptio-authenticator-aws</code> properly</p>

<p>I was running <code>helm</code> version 2.8.2 when obtaining this error, upgrading to v2.9.1 fixed this!</p>
