I'm having trouble connecting to the python kubernetes client, but I'm getting this 404 url not found error when I run curl -k https://ip-address:30000/pods which is an endpoint I wrote to connect to kubernetes & list pods. I'm running this locally through minikube, any suggestions on what to do?

The error:

Reason: Unauthorized
HTTP response headers: HTTPHeaderDict({'Content-Type': 'application/json', 'Content-Length': '129', 'Date': 'Wed, 18 Jul 2018 01:08:30 GMT'})
HTTP response body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"Unauthorized","reason":"Unauthorized","code":401}  

How I'm connecting to api:

from kubernetes import config,client
from kubernetes.client import Configuration, ApiClient

config = Configuration()
config.api_key = {'authorization': 'Bearer my-key-here'}
config.ssl_ca_cert = '/etc/secret-volume/ca-cert'
config.cert_file = 'ca-cert.crt'
config.key_file = '/etc/secret-volume/secret-key'
config.assert_hostname = False
api_client = ApiClient(configuration=config)
v1 = client.CoreV1Api(api_client)

#I've also tried using below, but it gives sslcertifificate max retry error 
#so I opted for manual config above
try: 
   config.load_incluster_config()
except: 
   config.load_kube_config()
v1 = client.CoreV1Api()

the way I'm getting the api key is getting the decoded token from service account I created, however according to documentation here it says

on a server with token authentication configured, and anonymous access enabled, a request providing an invalid bearer token would receive a 401 Unauthorized error. A request providing no bearer token would be treated as an anonymous request.

so it seems like my api token is not valid somehow? however I followed the steps to decode it and everything. I was pretty much following this

My yaml files:

apiVersion: apps/v1beta1 
kind: Deployment
metadata:
  name: first-app
  namespace: test-ns
spec:
  selector:
    matchLabels:
      app: first-app
  replicas: 3 
  template: 
    metadata:
      labels:
        app: first-app
    spec:
      serviceAccountName: test-sa
      containers:
      - name: first-app
        image: first-app
        imagePullPolicy: IfNotPresent

        volumeMounts:
        - name: secret-volume
          mountPath: /etc/secret-volume
        ports: 
        - containerPort: 80
        env:
        - name: "SECRET_KEY"
          value: /etc/secret-volume/secret-key
        - name: "SECRET_CRT"
          value: /etc/secret-volume/secret-crt
        - name: "CA_CRT"
          value: /etc/secret-volume/ca-cert
      volumes:
        - name: secret-volume
          secret: 
            secretName: test-secret

---
apiVersion: v1
kind: Service
metadata:
  name: first-app
  namespace: test-ns
spec:
  type: NodePort
  selector:
    app: first-app
  ports:
  - protocol: TCP
    port: 443 
    nodePort: 30000

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: test-sa
  namespace: test-ns

---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: system:test-app
  namespace: test-ns
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - namespaces
  - services
  verbs:
  - '*'

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: system:test-app
  namespace: test-ns
subjects:
  - kind: ServiceAccount
    name: test-sa
    namespace: test-ns
roleRef:
  kind: ClusterRole
  name: system:test-app
  apiGroup: rbac.authorization.k8s.io