kubernetes.client.exceptions.ApiException: (401) Reason: Unauthorized

TL;DR: You reached the API server but your credentials are invalid or expired. Refresh them: re-run your cloud provider's get-credentials command (or re-authenticate), which rewrites the token/certs in your kubeconfig.

kubernetes.client.exceptions.ApiException: (401)
Reason: Unauthorized

Fix it

1. Confirm kubectl has the same problem: kubectl get pods. Expected: the same 401, proving it is credentials, not your code.
2. Refresh credentials for your platform (examples: gcloud container clusters get-credentials [name], az aks get-credentials, aws eks update-kubeconfig). Expected: kubeconfig rewritten with fresh auth.
3. Retry kubectl get pods. Expected: pods list.
4. Retry your Python code. Expected: ApiException gone.

When this applies

• ApiException with status 401 on any call.
• kubectl fails the same way.

When it doesn't

• kubectl works but Python fails: the client reads a different kubeconfig; set KUBECONFIG.
• The error is 403 Forbidden: auth is fine; RBAC denies the action.

Compatibility

• kubernetes client any version.

Why it happens

Tokens and client certificates expire. Cloud CLIs write short-lived tokens into kubeconfig, so a config that worked last week 401s today until refreshed.

Edge cases

• ServiceAccount tokens mounted in pods expire too; restart the pod to remount.
• Multiple contexts: make sure kubectl config current-context is the cluster you think.