// Comparison

Hacking Kubernetes vs Kubernetes Security: Which Should You Read?

Two cybersecurity books on Containers, compared honestly: who each is for, what each does best, and which to read first.

Intermediate

4/52021

Hacking Kubernetes

Threat-Driven Analysis and Defense

Andrew Martin, Michael Hausenblas

A threat-modeling tour of a Kubernetes cluster, component by component, that teaches you to harden defaults by first showing you how each one gets broken.

Intermediate

4/52018

Kubernetes Security

Liz Rice, Michael Hausenblas

Liz Rice and Michael Hausenblas's freely-available O'Reilly short on the Kubernetes-specific security model: API server, RBAC, network policy, secrets, and the typical hardening steps that move a cluster from default to defensible.

Read this if

Platform and security engineers who own clusters in production and want an attacker's map of where the soft spots are.

Engineers spinning up their first production cluster who need the 99-page distillation of what to do before the first incident. The freely available PDF makes it the obvious 'send to the team' reference for Kubernetes hardening basics.

Skip this if

Skip this if you are new to Kubernetes or want a step-by-step hardening checklist; it explains why more than it hands you copy-paste configs.

Readers needing depth on runtime detection, supply-chain integrity, multi-cluster identity, or service-mesh security; the book is deliberately a primer, not a comprehensive reference. By 2026 Pod Security Admission, Gateway API, and signed-image standards have moved past the book's coverage.

Key takeaways

Default Kubernetes is built for convenience, not safety, and every chapter shows a default that an attacker is grateful for.
Container breakout, lateral movement, and supply-chain compromise are the threats that actually matter, not the ones the dashboards highlight.
Defense is layered: a single misconfigured RBAC binding or hostPath mount undoes everything else.

The Kubernetes security model is API-server-centric — most attacks are RBAC and network-policy failures, and the book makes this its spine.
Default-deny network policy is the highest-leverage hardening step in any cluster, and the book's framing of why is the most quotable in print.
Treat it as the on-ramp — once you have the basics, graduate to Kubernetes Security and Observability (Creane / Gupta) and current CNCF guidance.

How they compare

Hacking Kubernetes and Kubernetes Security are both rated 4/5 in our catalog. Pick by topic preference and reading style rather than by rating.

Both books target intermediate-level readers, so the choice is about topic, not difficulty.

Hacking Kubernetes and Kubernetes Security both cover Containers, Cloud, so reading them in sequence reinforces the same material from different angles.

Keep reading