feat(lab7): trivy + PSS restricted + conftest gate

[Maflock]

Goal

Scan Juice Shop image with Trivy (CVE + misconfig + secrets), harden a Kubernetes deployment of it with Pod Security Standards + NetworkPolicy + securityContext, and write a Conftest policy that gates non-compliant pods.

Changes

• Added submissions/lab7.md
• Added labs/lab7/k8s/namespace.yaml
• Added labs/lab7/k8s/serviceaccount.yaml
• Added labs/lab7/k8s/deployment.yaml
• Added labs/lab7/k8s/networkpolicy.yaml
• Added labs/lab7/policies/pod-hardening.rego

Testing

• Trivy image scan: 48 vulnerabilities (5 CRITICAL, 43 HIGH)
• Fix available: 46 out of 48 (95.8%)
• K8s deploy: juice-shop pod Running 1/1 on kind-lab7
• Trivy k8s scan: 5 CRITICAL, 43 HIGH

---

Artifacts & Screenshots

• submissions/lab7.md
• labs/lab7/k8s/namespace.yaml
• labs/lab7/k8s/serviceaccount.yaml
• labs/lab7/k8s/deployment.yaml
• labs/lab7/k8s/networkpolicy.yaml
• labs/lab7/policies/pod-hardening.rego

Checklist

• Title is clear (feat(lab7): trivy + PSS restricted + conftest gate)
• No secrets/large temp files committed
• submissions/lab7.md exists
• Task 1 — Trivy image + config scans + Grype comparison
• Task 2 — Hardened K8s deployment with PSS restricted + NetworkPolicy
• Bonus — Conftest policy passing on hardened + failing on bad manifest