diff --git a/config/kube_config.py b/config/kube_config.py
index 3691a18b..ded2ea1b 100644
--- a/config/kube_config.py
+++ b/config/kube_config.py
@@ -261,7 +261,7 @@ def _load_oid_token(self, provider):
 
         if PY3:
             jwt_attributes = json.loads(
-                base64.b64decode(parts[1] + padding).decode('utf-8')
+                base64.urlsafe_b64decode(parts[1] + padding).decode('utf-8')
             )
         else:
             jwt_attributes = json.loads(
diff --git a/config/kube_config_test.py b/config/kube_config_test.py
index 12d6916d..2a5ae789 100644
--- a/config/kube_config_test.py
+++ b/config/kube_config_test.py
@@ -46,6 +46,8 @@ def _base64(string):
 def _unpadded_base64(string):
     return base64.b64encode(string.encode()).decode().rstrip('=')
 
+def _unpadded_base64_urlsafe(string):
+    return base64.urlsafe_b64encode(string.encode()).decode().restrip('=')
 
 def _format_expiry_datetime(dt):
     return dt.strftime(EXPIRY_DATETIME_FORMAT)
@@ -86,7 +88,7 @@ def _raise_exception(st):
 TEST_CLIENT_KEY = "client-key"
 TEST_CLIENT_KEY_BASE64 = _base64(TEST_CLIENT_KEY)
 TEST_CLIENT_CERT = "client-cert"
-TEST_CLIENT_CERT_BASE64 = _base64(TEST_CLIENT_CERT)
+TEST_CLIENT_CERT_BASE64 = _unpadded_base64_urlsafe(TEST_CLIENT_CERT)
 
 
 TEST_OIDC_TOKEN = "test-oidc-token"