My goal was to run Kodi 18 on a vanilla Raspbian, install the Netflix add-on, and tunnel all traffic via a VPN. A great number of tutorials exist for that purpose, but none of them was entirely correct or up to date. At the time of writing, 2019-08-11, there are a number of obstacles to overcome. It took me the better part of an afternoon to piece the following together from several sources, with the general approach for the Netflix add-on - differing in details - following the instructions at https://www.makeuseof.com/tag/netflix-amazon-video-plex-raspberry-pi/. The advantage of installing Kodi on a normal Raspbian (instead of opting for LibreElec and other media centre-focusing distributions) is that you can use a variety of other software and, importantly, can use VPN clients other than OpenVPN. Admittedly, I haven't tried OpenVPN in a long while and I think it will have the necessary performance, but I actually like the ExpressVPN client for its ease of use, so I wanted to run that one.
I used a Raspberry Pi 3 with Raspbian Stretch - not Buster. For some reason, the Buster repositories contain only the older Kodi 17, for which I could not find a workable Netflix add-on. The Raspberry homepage hides the older Stretch version, find it on https://downloads.raspberrypi.org/raspbian_full/images/raspbian_full-2019-04-09/ and install Raspbian the usual way.
On Stretch, you can simply do apt install kodi and apt install kodi-inputstream-adaptive. The latter is required for Netflix but not pulled in by default.
This should give you a working Kodi 18 - try it out.
The Netflix add-on needs pycryptodome installed, which is not standard on Stretch. Install under your normal user (not root) with pip: pip install --user pycryptodomex. I also added the symlink, although I believe it is not strictly necessary: sudo ln -s /usr/lib/python2.7/dist-packages/Crypto /usr/lib/python2.7/dist-packages/Cryptodome.
Most tutorials will point you to the asciidisco repository. This did not work for me - the error was that Kodi couldn't connect to it. After some searching, I found the more modern repository by CastagnaIT: https://github.com/CastagnaIT/plugin.video.netflix. This worked very well. The direct link is: https://github.com/castagnait/repository.castagnait/raw/master/repository.castagnait-1.0.0.zip.
Install this repository by going to the Kodi add-ons, Install from zip file, and choosing the zip file. This install the repository under Kodi.
Now go to add-ons again, select Install from repository, and choose the Netflix addon repository, then Video add-ons, then Netflix. Make sure no error is displayed during the installation.
I am not sure if a reboot is strictly necessary, but I did one at this point.
Next, configure Kodi to use the adaptive InputStream, which is needed to decode Netflix: Go to the add-on settings again, find my My add-ons, choose VideoPlayer InputStream and set it to InputStream Adaptive.
You will need to configure your Netflix account next. There was no Switch account or the like; I was queried for username and password on opening Netflix.
Netflix still needs the Widevine CMD decryption module. Fortunately, the add-on can fetch it for you. Try to stream a video and you are asked a number of questions, which you all answer with Yes - this will fetch the necessary module from a ChromeOS image. It takes a little while.
I used ExpressVPN and installed the client as per their instructions. I am sure pretty much any other VPN client will also work. Start it before Kodi, and you are good to go.