Terraform created our new EKS cluster cleanly, then nobody could use it: kubectl said we must be logged in, and the Helm step in CI failed the same way. The cluster had API-only authentication, no creator admin, and access entries for the wrong role ARNs.
A dashboard service account had a Role and RoleBinding for its namespace, yet every request failed with forbidden at the cluster scope, because the client listed pods across all namespaces. How Roles, ClusterRoles and bindings combine, how to debug with kubectl auth can-i, and a fix without cluster-wide read.
kubectl apply returns in milliseconds, but a container can take a minute to start. We trace every hop: API server, admission, etcd, controllers, scheduler, kubelet, CRI, CNI and probes, and show which command reveals each stage.