Authentik OIDC for Kubernetes API Authentication

Problem

Setting up Authentik as an OIDC identity provider for Kubernetes kubectl access involves multiple non-obvious pitfalls that cause silent failures at different stages of the authentication flow.

Context / Trigger Conditions

• Setting up multi-user kubectl access with OIDC
• Using Authentik as the identity provider and kubelogin (int128/kubelogin) as the kubectl plugin
• Any of these errors:
  • oidc: email not verified
  • oidc: parse username claims "email": claim not present
  • The request fails due to a missing, invalid, or mismatching redirection URI
  • JWKS endpoint (/application/o/<app>/jwks/) returns {}
  • Unauthorized after successful browser login

Solution