title: python kubernetes api connection unauthorized 401
body: <p>I'm having trouble connecting to the python kubernetes client, but I'm getting this 404 url not found error when I run <code>curl -k https://ip-address:30000/pods</code> which is an endpoint I wrote to connect to kubernetes &amp; list pods. I'm running this locally through minikube, any suggestions on what to do? </p>
  
  <p>The error: </p>
  
  <pre><code>Reason: Unauthorized
  HTTP response headers: HTTPHeaderDict({'Content-Type': 'application/json', 'Content-Length': '129', 'Date': 'Wed, 18 Jul 2018 01:08:30 GMT'})
  HTTP response body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"Unauthorized","reason":"Unauthorized","code":401}  
  </code></pre>
  
  <p>How I'm connecting to api: </p>
  
  <pre><code>from kubernetes import config,client
  from kubernetes.client import Configuration, ApiClient
  
  config = Configuration()
  config.api_key = {'authorization': 'Bearer my-key-here'}
  config.ssl_ca_cert = '/etc/secret-volume/ca-cert'
  config.cert_file = 'ca-cert.crt'
  config.key_file = '/etc/secret-volume/secret-key'
  config.assert_hostname = False
  api_client = ApiClient(configuration=config)
  v1 = client.CoreV1Api(api_client)
  
  #I've also tried using below, but it gives sslcertifificate max retry error 
  #so I opted for manual config above
  try: 
     config.load_incluster_config()
  except: 
     config.load_kube_config()
  v1 = client.CoreV1Api()
  </code></pre>
  
  <p>the way I'm getting the api key is getting the decoded token from service account I created, however according to documentation <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/" rel="nofollow noreferrer">here</a> 
  it says  </p>
  
  <blockquote>
    <p>on a server with token authentication configured, and anonymous access
    enabled, a request providing an invalid bearer token would receive a
    401 Unauthorized error. A request providing no bearer token would be
    treated as an anonymous request.</p>
  </blockquote>
  
  <p>so it seems like my api token is not valid somehow? however I followed the steps to decode it and everything. I was pretty much following <a href="https://stackoverflow.com/questions/48151388/kubernetes-python-client-authentication-issue/48377444#48377444">this</a> </p>
  
  <p>My yaml files: </p>
  
  <pre><code>apiVersion: apps/v1beta1 
  kind: Deployment
  metadata:
    name: first-app
    namespace: test-ns
  spec:
    selector:
      matchLabels:
        app: first-app
    replicas: 3 
    template: 
      metadata:
        labels:
          app: first-app
      spec:
        serviceAccountName: test-sa
        containers:
        - name: first-app
          image: first-app
          imagePullPolicy: IfNotPresent
  
          volumeMounts:
          - name: secret-volume
            mountPath: /etc/secret-volume
          ports: 
          - containerPort: 80
          env:
          - name: "SECRET_KEY"
            value: /etc/secret-volume/secret-key
          - name: "SECRET_CRT"
            value: /etc/secret-volume/secret-crt
          - name: "CA_CRT"
            value: /etc/secret-volume/ca-cert
        volumes:
          - name: secret-volume
            secret: 
              secretName: test-secret
  
  ---
  apiVersion: v1
  kind: Service
  metadata:
    name: first-app
    namespace: test-ns
  spec:
    type: NodePort
    selector:
      app: first-app
    ports:
    - protocol: TCP
      port: 443 
      nodePort: 30000
  
  ---
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: test-sa
    namespace: test-ns
  
  ---
  kind: ClusterRole
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: system:test-app
    namespace: test-ns
  rules:
  - apiGroups:
    - ""
    resources:
    - pods
    - namespaces
    - services
    verbs:
    - '*'
  
  ---
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: system:test-app
    namespace: test-ns
  subjects:
    - kind: ServiceAccount
      name: test-sa
      namespace: test-ns
  roleRef:
    kind: ClusterRole
    name: system:test-app
    apiGroup: rbac.authorization.k8s.io
  </code></pre>