Authentik is definitely the best of all I've tried. It has the most features, supporting both ldap and oauth, and also has an official helm chart.

I have been using Authentik for several years now, works great with k8s. Not sure about the difference between Keycloak and Authentik tho (feature vise)

https://github.com/lldap/lldap is much simpler.

I use Authelia and its worked perfect to put auth in front of my services, including OAuth

I've been using Authentik for a while now and it works very well. There is also a Teraform provider to manage it as code. I do mostly OIDC, but also use it as a proxy for a few things that do not support that and just need to be locked down (Esp home and longhorn dashboards for example).

The disadvantage is that it is not the lightest option. If that is important to you, look at Authelia.

I used to love keycloak, but lately they've made changes that make client setup feel very complicated. I switched to authentik a while back and I feel it's far easier to deal with. 

Keycloak is amazing for no money, I use it connected to my Google workspace.

Keycloak has some learning curve, but it's the best OpenID Connect client and the most configurable and feature rich open source SSO system with the fewest major issues that I've used. And I use traefik for a reverse proxy, so for things that don't support SSO directly thomseddon/traefik-forward-auth works flawlessly with Keycloak to provide an auth layer to those apps.

For very simple Kubernetes and Docker environments, I've used Dex IdP with good results. It's low on features, but easy to set up.

Keycloak seems a little bit faster in my case, and it is simpler to setup. It has less containers.

However Authentik is has more features.

So, depending on your use case, I'd use one of those. Both are great!