The New Stack Book 2: Kubernetes Deployment and Security Patterns is a 2018 ebook about Kubernetes’ then-emerging production challenges. Its themes—security, scaling, infrastructure choices, and operational complexity—still matter, but its survey figures describe respondents in Fall 2017, not Kubernetes use today. For current deployments, Kubernetes guidance treats security as a set of layered controls, while safe rollouts depend on controllers and correctly configured health probes.
What the 2018 ebook covers—and what its evidence can tell you
The New Stack’s ebook frames production Kubernetes as a question that could not be answered quickly. Its introduction asks, “How well does Kubernetes work in production? We still don’t know.” That was the publication’s editorial view in 2018, not a current verdict. The available copy is a third-party mirror reproducing the ebook, whose title page credits The New Stack and shows © 2018; it is not a publisher-hosted original. The reproduced ebook discusses security resilience, operating at scale, infrastructure choices such as cloud and on-premises environments, and the organizational complexity of deployment.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
The New Real Book, Volume 2 (Key of C) | $45.00 | Buy on Amazon |
| 2 |
|
The New Real Book | $47.00 | Buy on Amazon |
| 3 |
|
FJH Federation Favorites, Book 2 | $9.50 | Buy on Amazon |
| 4 |
|
Alexander and the Terrible, Horrible, No Good, Very Bad Day | $7.15 | Buy on Amazon |
| 5 |
|
Classified as Murder (Cat in the Stacks Mystery) | $9.31 | Buy on Amazon |
The ebook presents survey analysis attributed to CNCF survey respondents, including surveys conducted in Fall 2017. The reproduced text notes that recruitment was not a random sample and gives sample sizes for individual charts. These numbers are useful as a snapshot of the challenges reported by that survey population, not as estimates for all organizations or for 2026.
- 69% of surveyed organizations used Kubernetes to manage containers.
- 46% of surveyed Kubernetes users cited security as a challenge.
- 23% cited scaling deployments based on load as a challenge.
- 24% of surveyed organizations ran 1,000 or more containers at a time.
Each figure is The New Stack’s analysis of CNCF survey responses collected in Fall 2017. They should be read as historical sample findings, not current adoption or prevalence statistics.
Recommended Free Tools
#1 Best Overall
- Used Book in Good Condition
How to apply the ebook’s security themes to a deployment now
No single Kubernetes setting secures a cluster. The current Kubernetes security checklist spans network policy, API and node exposure, workload permissions, secrets, and resource constraints; application guidance adds workload-level hardening. Exact availability and behavior depend on the cluster, network implementation, runtime, operating system, and provider. Review the guidance for the Kubernetes version and environment you actually run.
Choose a Pod Security Standard that workloads can meet
Kubernetes defines three cumulative Pod Security Standard levels: Privileged, Baseline, and Restricted. Privileged is intentionally open; Restricted is the strictest. Pod Security Admission is stable from Kubernetes v1.25 and applies policy at namespace level. Its modes are enforce, audit, and warn; namespace labels can pin the policy version. See Pod Security Standards and Pod Security Admission.
Rank #2
- Used Book in Good Condition
Assess workloads in their namespaces before enforcing a stricter level. Warning and audit modes can expose compatibility issues before enforcement. Some workloads legitimately need elevated permissions; document, constrain, and review those exceptions instead of assuming every workload can run unchanged under Restricted.
Limit network paths, identities, and control-plane exposure
Use ingress and egress NetworkPolicies for workloads where the cluster’s network implementation supports them. A default-deny approach can help prevent workloads from remaining outside the policy selection. The Kubernetes security checklist also advises against publicly exposing the API server, kubelet API, or etcd, and recommends restricting access to cloud metadata services when workloads do not need it.
Rank #3
- Instrument: Piano
- Category: Piano Collection
- Contributors: By Edwin McLean, Peggy Gallagher / ed. Edwin McLean, Peggy Gallagher
- ISBN 10: 1619280264
- ISBN 13: 9781619280267
For application access to the Kubernetes API, use a distinct service account where appropriate and set automountServiceAccountToken: false unless the workload needs the token. Grant narrow permissions: creating or modifying workload resources can itself enable powerful access. See Application Security Checklist.
Harden containers and bound resource use
Where supported, consider security-context controls such as seccomp, AppArmor, and SELinux. A different runtime class or stronger isolation may be appropriate for workloads with a threat model that warrants it. These controls depend on the operating system, runtime, and cluster configuration.
Rank #4
Set resource requests and limits to reflect observed workload behavior and the constraints of the environment. Kubernetes’ checklist particularly calls out memory limits; application guidance says the memory limit should be equal to or greater than the request, and that CPU limits may suit sensitive workloads. A limit is not a substitute for understanding workload behavior or provider constraints.
Treat secrets and stored data as separate controls
A Kubernetes Secret object is basic protection for confidential configuration values, not a complete security solution. Consider encryption at rest for control-plane data and separately establish how workload data is protected at rest. The Kubernetes security overview also points users of hosted clusters to their provider’s security documentation.
Best Value
Make rollout and recovery behavior part of deployment design
Kubernetes workload controllers manage Pod replication, rollout, and automatic recovery. Their effectiveness depends on defining health in terms the application actually supports. Startup, readiness, and liveness probes are distinct mechanisms; an incorrect probe can cause unnecessary restarts or contribute to unbounded processes and resource starvation. See Workload controllers and Liveness, Readiness, and Startup Probes.
- Startup probe: allows a slow-starting application time to become ready; liveness and readiness checks do not run until startup succeeds.
- Readiness probe: determines whether a Pod should receive traffic. It should reflect whether the application can serve requests, not merely whether its process exists.
- Liveness probe: detects a condition that warrants restarting the container. It should not treat a temporary dependency outage as proof that the application process must be restarted.
Set probe thresholds and timing around actual startup and recovery behavior. A controller can restore a Pod, but it cannot make a bad health check meaningful.
Choose managed, self-managed, cloud, or on-premises by responsibility
The ebook raises infrastructure choice, but the available evidence does not establish a universally best hosting model or current price/performance ranking. Compare options against the work your team can own and the requirements of the workload. For hosted clusters, provider security guidance is part of that decision; for any environment, verify which controls are actually implemented.
| Decision axis | Questions to answer |
|---|---|
| Operational responsibility | Which party operates the control plane and underlying infrastructure? Which node, upgrade, backup, and recovery tasks remain yours? |
| Security ownership | Who manages identity, API exposure, network policy, node hardening, and encryption? What does the provider document, and what must you configure? |
| Workload fit | Does the workload require a particular operating system, privileged access, storage or network behavior, or a Pod Security level that needs compatibility work? |
| Deployment and recovery | Can the chosen environment support the required rollout behavior, probes, resource requests and limits, and operational monitoring? |
| Economics and performance | What do the workload’s measured capacity and performance needs imply for infrastructure and operating costs? The ebook raises price and performance as considerations, but the cited material supplies no current comparison or benchmark. |
For either cloud or on-premises infrastructure, validate the network implementation, runtime support, and provider or platform responsibilities before relying on a control. The Kubernetes security checklist is guidance; it does not prove that a particular cluster has implemented a feature.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
