# A Kubernetes escape room at KubeCon, Nov 11 in Salt Lake City Canonical: https://brew.new/templates/goteleport/a-kubernetes-escape-room-at-kubecon-nov-11-in-salt-lake-city Brand: goteleport.com Category: general ![Preview of A Kubernetes escape room at KubeCon, Nov 11 in Salt Lake City](https://cdn.brew.new/email-preview-9c5b807d113b13b2-tracking_r57npp9zmk039kb9bqnbcz6whh8gm39b-1792513268499.png) ## Email content Teleport New in Identity Teleport — The AI Infrastructure Identity Company Teleport Beams, trusted runtimes for infrastructure agents, will be generally available on Nov 9. KubeCon + CloudNativeCon North America opens the next day in Salt Lake City with Teleport at Booth 103. On Wednesday night, we're co-hosting a Kubernetes escape room at Edison House where teams solve hands-on cluster challenges to rescue Phippy, the CNCF's Kubernetes mascot. Before you go, the three posts in this issue trace what a cluster trusts at each step of a request: the login token it accepts, the name it writes to the audit log, and the permissions a ServiceAccount collects over the years. Rescue Phippy: A Kubernetes Escape Room at KubeCon Phippy needs rescuing, and getting her out takes working Kubernetes skills. On Wednesday, Nov 11, from 7 PM to midnight MST, teams of 3–4 solve hands-on challenges at Edison House, with each solved room unlocking the next and better food and drinks along the way. Register ahead to receive the pre-event challenge, which secures your spot and earns the code word you need at the door. Teleport co-hosts with Buoyant, Merge Forward, Dash0, and Civo. Bring a laptop, or complete two on-site challenges and join the main-floor party for drinks, catering, and DJ sets. RSVP today → Meet Teleport at Booth 103 in Salt Lake City Teleport is a Platinum Sponsor of KubeCon + CloudNativeCon North America, Nov 10–12 at the Salt Palace Convention Center. Stop by Booth 103 to see Beams, launching Nov 9, which runs agents in ephemeral micro-VMs that reach your infrastructure without secrets. The Teleport team also shows how short-lived certificates replace static kubeconfigs and long-lived credentials for engineers and workloads. Catch the Teleport Demo Theater session on Tuesday, Nov 10, at 3:25 PM MST, or find our table at Platform Engineering Day on Monday, Nov 9. Our KubeCon plans → SSO-Backed kubectl Access Across Many Clusters By Daniele Polencic When development, staging, and production clusters trust one OpenID Connect (OIDC) issuer and audience, Kubernetes accepts one kubectl token across all three. Role-based access control (RBAC) can block Alice's command in production, but her token passes authentication before RBAC runs. The post walks through a Dex and kubelogin setup and shows how an audience per cluster lets production reject a development token at authentication. Read the full post → How to Tie Kubernetes Audit Logs to Individual Engineers By Daniele Polencic Kubernetes takes the audit username from the client certificate's common name, so two engineers who carry one certificate produce audit events that match field for field. The audit record ends when a kubectl exec connection opens, and the log records none of the commands an engineer types inside the shell. You will learn how to give each engineer an identity of their own, carry that identity through proxies and cloud identity and access management (IAM), and add a session recorder when you need to review terminal activity. Read the full post → How to Reduce Overprivileged Kubernetes Service Accounts By Justin O'Leary One platform team carried cluster-admin bindings in 14 clusters across three clouds, all from one Terraform module that every cluster inherited. GitOps controllers restore the binding when an engineer deletes it, and a ServiceAccount that federates to a cloud role can write to Amazon S3 buckets outside the reach of Kubernetes RBAC. To cut that exposure, trim each workload's RBAC to the verbs and resources it uses, limit its cloud permissions, and swap tokens that outlive their Pods for certificates that expire. Read the full post → Have questions or want to keep the conversation going? Join us in our Community Slack → If you found this useful, pass it along to someone else who would, too. Thanks for reading, The Teleport Editorial Team P.S. We'll be at these events over the next few weeks. Come find us. Oct 21: Platform Engineering & Developer Experience Summit, London Nov 4: Cloud Native London Meet Up Nov 5: Paris Identity Summit 2026 Nov 9–12: KubeCon + CloudNativeCon North America, Salt Lake City, Booth 103 Find us near you: https://goteleport.com/events/ Teleport, 2100 Franklin St, Suite 400, Oakland, CA 94612 If you no longer wish to receive these emails anymore, click on the following link: UNSUBSCRIBE TERMS OF SERVICE | PRIVACY POLICY | SECURITY POLICY [Open and remix this design](https://brew.new/templates/goteleport/a-kubernetes-escape-room-at-kubecon-nov-11-in-salt-lake-city) [Browse email designs](https://brew.new/browse/templates)