title: Helm on AWS EKS
body: <p>Having my cluster up and running on AWS EKS, I'm finding trouble running <code>helm init</code> with the following error:</p>
  
  <pre><code>$ helm init --service-account tiller --upgrade
  Error: error installing: deployments.extensions is forbidden: User "system:anonymous" cannot create deployments.extensions in the namespace "kube-system"
  </code></pre>
  
  <p><code>kubectl</code> works properly (object retrieval, creation and cluster administration), authenticating and authorizing correctly by running <code>heptio-authenticator-aws</code> at connection time ( with an <code>exec</code> section in the kubectl config).</p>
  
  <p>In order to prepare the cluster for helm, I created the service account and role binding as specified in the helm <a href="https://github.com/kubernetes/helm/blob/master/docs/rbac.md" rel="nofollow noreferrer">docs</a>.</p>
  
  <p>I've heard of people having helm running on EKS, and I'm guessing they're skipping the <code>exec</code> section of the kubectl config by hardcoding the token... I'd like to avoid that!</p>
  
  <p>Any ideas on how to fix this? My guess is that it is related to helm not being able to execute <code>heptio-authenticator-aws</code> properly</p>