python kubernetes api connection unauthorized 401 - kubernetes

Question

I'm having trouble connecting to the python kubernetes client, but I'm getting this 404 url not found error when I run curl -k https://ip-address:30000/pods which is an endpoint I wrote to connect to kubernetes & list pods. I'm running this locally through minikube, any suggestions on what to do?
The error:
Reason: Unauthorized
HTTP response headers: HTTPHeaderDict({'Content-Type': 'application/json', 'Content-Length': '129', 'Date': 'Wed, 18 Jul 2018 01:08:30 GMT'})
HTTP response body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"Unauthorized","reason":"Unauthorized","code":401}
How I'm connecting to api:
from kubernetes import config,client
from kubernetes.client import Configuration, ApiClient
config = Configuration()
config.api_key = {'authorization': 'Bearer my-key-here'}
config.ssl_ca_cert = '/etc/secret-volume/ca-cert'
config.cert_file = 'ca-cert.crt'
config.key_file = '/etc/secret-volume/secret-key'
config.assert_hostname = False
api_client = ApiClient(configuration=config)
v1 = client.CoreV1Api(api_client)
#I've also tried using below, but it gives sslcertifificate max retry error
#so I opted for manual config above
try:
config.load_incluster_config()
except:
config.load_kube_config()
v1 = client.CoreV1Api()
the way I'm getting the api key is getting the decoded token from service account I created, however according to documentation here
it says
on a server with token authentication configured, and anonymous access
enabled, a request providing an invalid bearer token would receive a
401 Unauthorized error. A request providing no bearer token would be
treated as an anonymous request.
so it seems like my api token is not valid somehow? however I followed the steps to decode it and everything. I was pretty much following this
My yaml files:
apiVersion: apps/v1beta1
kind: Deployment
metadata:
name: first-app
namespace: test-ns
spec:
selector:
matchLabels:
app: first-app
replicas: 3
template:
metadata:
labels:
app: first-app
spec:
serviceAccountName: test-sa
containers:
- name: first-app
image: first-app
imagePullPolicy: IfNotPresent
volumeMounts:
- name: secret-volume
mountPath: /etc/secret-volume
ports:
- containerPort: 80
env:
- name: "SECRET_KEY"
value: /etc/secret-volume/secret-key
- name: "SECRET_CRT"
value: /etc/secret-volume/secret-crt
- name: "CA_CRT"
value: /etc/secret-volume/ca-cert
volumes:
- name: secret-volume
secret:
secretName: test-secret
---
apiVersion: v1
kind: Service
metadata:
name: first-app
namespace: test-ns
spec:
type: NodePort
selector:
app: first-app
ports:
- protocol: TCP
port: 443
nodePort: 30000
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: test-sa
namespace: test-ns
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: system:test-app
namespace: test-ns
rules:
- apiGroups:
- ""
resources:
- pods
- namespaces
- services
verbs:
- '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: system:test-app
namespace: test-ns
subjects:
- kind: ServiceAccount
name: test-sa
namespace: test-ns
roleRef:
kind: ClusterRole
name: system:test-app
apiGroup: rbac.authorization.k8s.io