If the person who set up your cluster networking has moved teams, the CNI and the mesh are probably the parts nobody can explain during an incident. Kubernetes networking books are still the fastest way to close that gap, but print ages badly here. Istio ambient mode went GA in November 2024 and open source Linkerd stopped shipping stable releases in February 2024. Cilium can now replace kube-proxy, your ingress controller and much of the mesh from one agent.
So we judged seven Cilium, Istio, Linkerd and eBPF books on what they still teach correctly. We checked every edition, seller and price band on Amazon US on October 31, 2026. We also cloned every companion repository we could find to see which Kubernetes, Cilium and Istio versions it pins, so the version gaps below come from the code rather than the back cover. If you are still picking a first Kubernetes book, our Kubernetes books by skill level is the better starting point.
Seven networking and service mesh books compared
The table sorts the shelf by the layer each book teaches, because a CNI book and a mesh book answer different on-call questions. Read the “Covers” column first. It tells you whether a book knows about the Gateway API, ambient mode or a sidecarless datapath, and that is where most 2021 and 2022 titles fall short.
| Book | Best for | Published | Pages | Covers | Price band |
|---|---|---|---|---|---|
| Cilium: Up and Running | Most platform teams | Mar 2026 | 370 | eBPF datapath, kube-proxy replacement, Gateway API, sidecarless mesh | $50 to $65 |
| Networking and Kubernetes | Packet path fundamentals | Oct 2021 | 338 | Linux networking, CNI, kube-proxy modes, Services, cloud CNIs | $40 to $55 |
| Learning eBPF | Reading the datapath code | Apr 2023 | 234 | eBPF programs, XDP and TC networking, libbpf | $35 to $50 |
| Istio in Action | Understanding Envoy and sidecars | Apr 2022 | 480 | Sidecar mesh, Envoy, mTLS, multicluster, troubleshooting | $50 to $60 |
| Practical Istio | Newest Istio text | Aug 2025 | 584 | Sidecar mesh, a first look at ambient, production on EKS | $50 to $60 |
| Linkerd: Up and Running | Teams running Linkerd | May 2024 | 259 | Linkerd proxy, policy, mTLS, multicluster, CNI plugin | $25 to $45 |
| Bootstrapping Service Mesh Implementations with Istio | Istio on EKS | Apr 2023 | 418 | Sidecar mesh, Wasm, OPA Gatekeeper, other meshes compared | $40 to $50 |
Prices move daily, so check the current price on Amazon before you pay. Six of the seven were sold by Amazon.com on the day we checked. The exception is Linkerd: Up and Running, whose buy box belonged to a marketplace seller at well under list price. That is why its band starts so low, and why you should look at the seller before ordering.
What the companion repos pin
A networking book is only as current as the manifests you will copy out of it, so we cloned each companion repository and read what it pins. That tells you more than a publication date. A 2022 book whose manifests the current release still accepts ages better than a 2021 book whose YAML a modern API server rejects.
| Book | Repo last commit | What the code pins | On a current cluster |
|---|---|---|---|
| Cilium: Up and Running | Sep 24, 2026 | kind node v1.33.4 in 79 places, Cilium Helm chart 1.17.5 to 1.18.4, Gateway API v1 | APIs current; Helm pins trail Cilium 1.20 |
| Networking and Kubernetes | Oct 27, 2021 | kind node v1.18.2, Cilium chart 1.9.1 | Chapter 5 ingress and MetalLB YAML uses APIs removed in Kubernetes 1.22 and 1.25 |
| Learning eBPF | Mar 23, 2026 | Ubuntu 22.04 with a 5.15 kernel | No Kubernetes objects to age |
| Istio in Action | Dec 1, 2022 | 481 networking.istio.io/v1alpha3 objects, proxy image 1.11.0 | Istio 1.31.3 still serves v1alpha3; no Gateway API or ambient |
| Practical Istio | Jan 20, 2026 | Mostly v1beta1, two Gateway API objects, one ambient kind config | APIs current; ambient only in chapter 2 |
| Linkerd: Up and Running | Apr 17, 2024 | Plain Deployments and Services, no Linkerd version | Version depends on the edge or vendor build you install |
| Bootstrapping Service Mesh with Istio | No public repo found | Not checked | Unknown |
Two rows change how you should read these books. The Networking and Kubernetes chapter 5 manifests carry an admissionregistration.k8s.io/v1beta1 webhook and policy/v1beta1 PodSecurityPolicy objects. The Kubernetes deprecation guide lists both as removed, so treat that chapter as theory and install ingress and MetalLB from current upstream charts. Istio in Action is the opposite case: its v1alpha3 VirtualServices look old, yet the Istio 1.31.3 CRDs still serve that version alongside v1, so the traffic chapters still apply.
We had planned to run each repo’s first chapter on a kind cluster as well. Our Proxmox lab was unreachable the day we did this review, so the table is a static reading of the code, not a test run. Every count in it comes from a grep over the cloned repositories, and the Istio claim comes from the CRD file shipped with the 1.31.3 release.
1. Cilium: Up and Running
This is the one we’d hand a platform team first, because it’s the only book here that teaches kube-proxy replacement, ingress and the Gateway API on the same eBPF datapath.
Nico Vibert, Filip Nikolic and James Laverack work at Isovalent, the company that created Cilium, and Cilium co-creator Thomas Graf wrote the foreword. Its 16 chapters follow the order you would build a cluster in: IPAM, the eBPF datapath, service networking with kube-proxy replacement, then ingress and the Gateway API including GAMMA for east-west traffic. The second half covers DSR, XDP and Maglev load balancing, ClusterMesh, BGP and L2 announcements, egress gateways, identity-based and L7 network policy, transparent encryption and Hubble.
The repo is the best maintained on this list, with a commit in September 2026. Most labs run on kind, so you can work through it on a laptop without a cloud bill. The Helm pins stop at 1.18.4 while upstream is on 1.20.4, which is normal for print and easy to bump. It doesn’t teach Istio, so a team running Istio on top of Cilium still needs a mesh book. Our own Cilium CNI production guide covers the kubeadm production install that the book’s kind labs stop short of.
- Buy it if: your clusters run Cilium today or you are replacing kube-proxy, an ingress controller or a sidecar mesh with it.
- Skip it if: you are on Calico or a cloud CNI and have no plan to move, since most chapters assume Cilium’s datapath.
- Pair it with: Learning eBPF, when you want to know what the agent is loading into the kernel.
2. Networking and Kubernetes: A Layered Approach
James Strong and Vallery Lancey wrote the book that explains why a packet takes the path it does, and that part hasn’t aged at all.
The six chapters climb the stack. After an OSI and TCP/IP refresher, chapter 2 covers Linux networking with bridges, Netfilter, conntrack, iptables, IPVS and a first look at eBPF. Container networking and CNI follow, then the Kubernetes model with kube-proxy modes, NetworkPolicy, DNS and dual stack. The last two chapters cover Services, EndpointSlices and Ingress, and how EKS, GKE and AKS wire pods into a VPC. Chapters 2 and 4 are the ones to keep open when conntrack or an iptables chain is the suspect, because no other book here spends that long below the CNI.
Its weakness is the code. The repo’s last commit was in October 2021, its kind nodes run Kubernetes 1.18 and its Cilium example installs chart 1.9.1, so read the theory and take your installs from upstream. If you follow its MetalLB section, our MetalLB install guide configures pools with IPAddressPool and L2Advertisement objects instead of the address-pools ConfigMap the book’s repo still ships.
- Buy it if: you can’t yet trace a request from a Service IP through iptables or IPVS to a pod.
- Skip it if: you want copy-paste manifests for a 1.3x cluster, because chapter 5’s will be rejected.
- Pair it with: Cilium: Up and Running, which picks up where its short eBPF section stops.
3. Learning eBPF
Liz Rice’s book isn’t about Kubernetes, but it’s the one that makes Cilium’s datapath and every sidecarless mesh readable.
Over 234 pages it goes from a BCC hello world through maps, the bpf() system call, CO-RE with BTF and libbpf, and the verifier, to program and attachment types. Chapter 8 is the networking chapter you are buying it for: XDP and TC programs, load balancing in the kernel, and how eBPF enforces network policy and encryption without iptables. That chapter also explains how eBPF networking avoids iptables in Kubernetes, and chapter 9 uses Cilium Tetragon as its security example.
The repo’s README says every example was tested on Ubuntu 22.04 with a 5.15 kernel, and it still took a commit in March 2026. That makes it the cheapest book here to stay current with, since eBPF itself changes slowly compared with mesh APIs. It’s a programming book, though, so expect C, and expect to read code rather than YAML. Our eBPF book list compares it with Brendan Gregg’s performance titles if tracing is your main interest.
- Buy it if: you debug Cilium or ambient mode and want to know what the kernel is running.
- Skip it if: you only operate a mesh through Helm values and never read datapath code.
- Pair it with: a lab VM on a 5.15 or newer kernel, because the examples need root.
4. Istio in Action
Christian Posta and Rinor Maloku’s book is still the deepest explanation of how Istio and Envoy behave once traffic goes wrong.
Chapter 3 is a full chapter on Envoy as the data plane, and that is the reason to own it. The 480 pages then cover gateways, traffic control, resilience, metrics with Grafana, Jaeger and Kiali, and mTLS. Two chapters go where most mesh books stop: troubleshooting the data plane and tuning the control plane. The last part handles multicluster, VM workloads and Wasm extensions.
It’s a sidecar-only book. Istio made ambient mode GA in 1.24, and the repo has no Gateway API objects at all, so you will learn the Istio Gateway and VirtualService model and translate from there. Because Istio 1.31 still serves those APIs, the traffic manifests should still apply. Watch the install path instead: the repo carries 19 IstioOperator files, and Istio removed the in-cluster operator in 1.24, so apply them with istioctl or move to Helm rather than deploying an operator. Our Istio mTLS and canary guide shows the same routing on a recent release.
- Buy it if: you run Istio with sidecars and want to read Envoy config dumps with confidence.
- Skip it if: you are adopting ambient mode from day one and will not run sidecars at all.
- Pair it with: Practical Istio for the newer APIs and a production deployment walkthrough.
5. Practical Istio
Apress published the newest Istio book from a major publisher in August 2025, and it’s the one to buy if Istio in Action feels dated.
Prashanth Josyula, Karanbir Singh and Anupam Mehta spread 584 pages over ten chapters. They run from core components and traffic management through gateway control, security and observability with Grafana and Kiali. The later chapters cover a production deployment on EKS (with Terraform in the repo), custom plugins and where Istio is heading. Its manifests use v1beta1 APIs and include two Gateway API objects, so the YAML is closer to what you’d write today.
Ambient mode gets less than the cover date suggests. The only ambient files in the repo are a kind config and a sample app in chapter 2, so treat it as a sidecar book that acknowledges ambient rather than an ambient guide. It also had a single Amazon review when we looked, which tells you how new it is more than how good.
- Buy it if: you want one current Istio book that ends in a production rollout on AWS.
- Skip it if: you need deep Envoy internals, which Istio in Action covers better.
- Pair it with: the Istio ambient docs, since no major publisher has an ambient book yet.
6. Linkerd: Up and Running
Jason Morgan and Flynn, both from Buoyant, wrote the only current Linkerd book from a major publisher, and it’s short enough to finish in a week.
Its 15 chapters run from service mesh basics through deploying Linkerd, ingress, the CLI, mTLS and certificate rotation. The second half covers policy, observability, retries and traffic shifting, multicluster, the Linkerd CNI plugin against init containers, production readiness and debugging. At 259 pages it’s the most compact book here. Two whole chapters go to policy, first per server and then per route, which is where you will spend your time once a namespace is locked down to default deny.
Check the release model before you follow its install steps. The Linkerd releases page says the open source project stopped providing stable release artifacts in February 2024, which leaves you with edge releases or a vendor’s stable build. The production chapter has a “Stable or Edge?” section on exactly this choice, and the repo pins no Linkerd version at all, so pick your channel before you copy anything.
- Buy it if: you already run Linkerd, or want a mesh with less to learn than Istio.
- Skip it if: your organisation will not accept edge releases or a vendor build for production.
- Check first: the seller, since the cheapest offer on our check date came from a marketplace seller.
7. Bootstrapping Service Mesh Implementations with Istio
Anand Rai’s Packt book is the most hands-on of the Istio titles for teams on AWS, at the cost of being the hardest to verify.
Chapter 2 starts on minikube, then chapter 4 builds an EKS cluster and deploys the Sockshop demo that most of the remaining 418 pages work on. Traffic management, resiliency, security and observability come first, then multicluster, Wasm extensions, VMs, OPA Gatekeeper and troubleshooting. Chapter 12 includes a short section on eBPF, and an appendix compares Consul Connect, Gloo Mesh, Kuma and Linkerd, which helps if you are still choosing a mesh.
We couldn’t find a public companion repository, so we can’t tell you which Istio release its examples assume. It also predates ambient mode GA by about a year and a half. Buy it for the EKS walkthrough and the mesh comparison, and expect to adjust the commands to a current Istio release as you go.
- Buy it if: you learn best by building one app end to end on EKS.
- Skip it if: you already own Istio in Action or Practical Istio, since the overlap is large.
- Budget for: an EKS cluster while you work through it, because most examples from chapter 4 on assume one.
Match the book to the layer you run
Most teams don’t need all seven, because the CNI and the mesh you already run decide which pages you will use. Start from what is in production today:
- Cilium as the CNI, no separate mesh: Cilium: Up and Running, then Learning eBPF when you need to read what the agent loads.
- Istio with sidecars: Istio in Action for Envoy and troubleshooting, Practical Istio for the newer APIs.
- Istio ambient: Learning eBPF plus the upstream ambient docs, because no major publisher has a book on it yet.
- Linkerd: Linkerd: Up and Running, and nothing else on this list covers it in depth.
- A cloud CNI on EKS, GKE or AKS: Networking and Kubernetes for the VPC chapter, then Bootstrapping Service Mesh if a mesh is next.
The Gateway API is the gap on every shelf. Only Cilium: Up and Running teaches it properly, Linkerd: Up and Running uses HTTPRoute for traffic shifting, and Practical Istio touches it. If you are moving off Ingress, our Gateway API migration guide covers the weighted and header routing the books leave out.
Books we left off the list
Several titles turn up in every search for Kubernetes networking books, and each one failed a specific check rather than a vague quality bar:
| Book | What it does well | Why it is not a pick |
|---|---|---|
| Kubernetes Security and Observability (O’Reilly, 2021) | NetworkPolicy chapters from the Calico team at Tigera | Teaches PodSecurityPolicy, removed in Kubernetes 1.25; Amazon stock status unclear on our check date |
| Observability Engineering with Cilium (Apress, 2025) | Hubble and Tetragon in depth | Amazon US listed only the Kindle edition |
| Istio: Up and Running (O’Reilly, 2019) | Short introduction to the sidecar model | Three years older than Istio in Action, which covers the same ground in more depth |
| Ultimate Istio and Ultimate Linkerd (Orange Education, Oct 2026) | Newest titles on both meshes | Too new for us to read a table of contents or companion code |
| Self-published Gateway API, Envoy and ambient titles | Cover the topics the big publishers have not | None came from a publisher we could check |
We would revisit the first two if a refreshed edition or a paperback appears, because both cover ground none of the seven picks do. The rest need a readable table of contents and working companion code before they are worth your money. A Gateway API or ambient book from a publisher with a technical review process would go straight onto this list.
A reading path as the cluster grows
The order matters more than the count. On a single cluster with a handful of services you need the packet path and one CNI. A mesh only earns its operating cost once you are running mTLS between dozens of services or across clusters. We’d read in this order and stop where your platform stops:
- One cluster, a few services: Networking and Kubernetes chapters 2 to 5, which also covers the Services and NetworkPolicy material on the CKA syllabus.
- Replacing kube-proxy or the ingress controller: Cilium: Up and Running, chapters 3 to 7.
- Debugging the datapath under load: Learning eBPF chapters 1 to 8, then Cilium’s performance chapter on DSR, XDP and Maglev.
- mTLS and traffic policy across many services: one mesh book, Istio in Action or Linkerd: Up and Running, chosen by the mesh you will actually run.
- Several clusters or regions: the multicluster chapters in Cilium: Up and Running and in your mesh book, read side by side.
If you are working toward the CKA or CKS at the same time, the exam study guides cover only the first step of that path. Keep the CKA, CKAD and CKS books for the syllabus and use these for what happens after the exam. In practice this means two books for most teams in the first year: Networking and Kubernetes plus Cilium: Up and Running. Add a mesh book only when a mesh is on the roadmap.
