Having my cluster up and running on AWS EKS, I'm finding trouble running helm init with the following error:

$ helm init --service-account tiller --upgrade
Error: error installing: deployments.extensions is forbidden: User "system:anonymous" cannot create deployments.extensions in the namespace "kube-system"

kubectl works properly (object retrieval, creation and cluster administration), authenticating and authorizing correctly by running heptio-authenticator-aws at connection time ( with an exec section in the kubectl config).

In order to prepare the cluster for helm, I created the service account and role binding as specified in the helm docs.

I've heard of people having helm running on EKS, and I'm guessing they're skipping the exec section of the kubectl config by hardcoding the token... I'd like to avoid that!

Any ideas on how to fix this? My guess is that it is related to helm not being able to execute heptio-authenticator-aws properly