Also switched to Kanidm, and using the Kubernetes operator someone made have made it easy to configure also.

I have custom resources that create HTTPRoutes and then protect public traffic with Kanidm by creating a a OAuthClient per site.

Chefs kiss.