I think we have just the (Open Source) solution for you: https://bit.ly/Keymasterhttps://github.com/Symantec/keymaster
This issues MFA-ed ephemeral credentials: SSH certs, Kerberos compatible X509 certs, X509 certs for Kubernetes and well as being an OpenID-Connect/OAuth2 IDentity Manager.