Kubernetes Security
Liz Rice and Michael Hausenblas's freely-available O'Reilly short on the Kubernetes-specific security model: API server, RBAC, network policy, secrets, and the typical hardening steps that move a cluster from default to defensible.
As an Amazon Associate we earn from qualifying purchases. The link above is sponsored.
- Authors
- Liz Rice,Michael Hausenblas
- Published
- 2018
- Publisher
- O'Reilly Media
- Pages
- 99
- Language
- English
Read this if
Engineers spinning up their first production cluster who need the 99-page distillation of what to do before the first incident. The freely available PDF makes it the obvious 'send to the team' reference for Kubernetes hardening basics.
Skip this if
Readers needing depth on runtime detection, supply-chain integrity, multi-cluster identity, or service-mesh security; the book is deliberately a primer, not a comprehensive reference. By 2026 Pod Security Admission, Gateway API, and signed-image standards have moved past the book's coverage.
Key takeaways
- The Kubernetes security model is API-server-centric — most attacks are RBAC and network-policy failures, and the book makes this its spine.
- Default-deny network policy is the highest-leverage hardening step in any cluster, and the book's framing of why is the most quotable in print.
- Treat it as the on-ramp — once you have the basics, graduate to Kubernetes Security and Observability (Creane / Gupta) and current CNCF guidance.
Notes
Available free from O'Reilly's site as the typical 'short' format. Pair with Container Security (Rice) for the layer below and with the Kubernetes documentation's own 'Securing a Cluster' guide as the live update. Dated only in that the field has moved; the conceptual scaffolding is still correct.
What to read before
What to read before Kubernetes Security →Intermediate · 2020
Container Security
Liz Rice's first-principles introduction to how Linux containers actually work — namespaces, cgroups, capabilities, seccomp, image layering — and the security implications that fall out of those mechanics.
Beginner · 2020
Alice and Bob Learn Application Security
Tanya Janca's hands-on AppSec primer covering threat modeling, secure design, secure coding, testing, deployment, and the social side of running an AppSec program — through a friendly, narrative-driven structure.
Intermediate · 2018
Pentesting Azure Applications
Matt Burrough on attacker behaviour against Azure tenants: identity, storage, VMs, key material handling, and the recon paths that work against real subscriptions.
What to read next
What to read after Kubernetes Security →Intermediate · 2020
Container Security
Liz Rice's first-principles introduction to how Linux containers actually work — namespaces, cgroups, capabilities, seccomp, image layering — and the security implications that fall out of those mechanics.
Advanced · 2021
Kubernetes Security and Observability
Brendan Creane and Amit Gupta's combined treatment of Kubernetes security and observability — RBAC, network policy, runtime detection, and the telemetry needed to make any of it operationally real.
Advanced · 2020
Building Secure and Reliable Systems
Google's site-reliability and security teams jointly write down what it actually takes to build systems that are both safe and dependable, from threat models and design reviews to rollback culture and crisis response.
Explore similar books
Alternatives to Kubernetes Security →Intermediate · 2020
Container Security
Liz Rice's first-principles introduction to how Linux containers actually work — namespaces, cgroups, capabilities, seccomp, image layering — and the security implications that fall out of those mechanics.
Advanced · 2021
Kubernetes Security and Observability
Brendan Creane and Amit Gupta's combined treatment of Kubernetes security and observability — RBAC, network policy, runtime detection, and the telemetry needed to make any of it operationally real.
Intermediate · 2018
Pentesting Azure Applications
Matt Burrough on attacker behaviour against Azure tenants: identity, storage, VMs, key material handling, and the recon paths that work against real subscriptions.