feat(lab7): trivy + PSS restricted + conftest gate

[Wilikson173]

Goal

Harden the Juice Shop Kubernetes deployment to Pod Security Standards restricted (securityContext, NetworkPolicy, dedicated ServiceAccount), run Trivy image/config/k8s scans, and add a Conftest/Rego policy gate that fails CI on non-compliant pods.

Changes

• labs/lab7/k8s/namespace.yaml — namespace with PSS labels (enforce/warn/audit: restricted)
• labs/lab7/k8s/serviceaccount.yaml — dedicated ServiceAccount with automountServiceAccountToken: false
• labs/lab7/k8s/deployment.yaml — hardened Deployment (pod + container securityContext, readOnlyRootFilesystem: true with emptyDir mounts, resource limits/requests, image pinned by digest)
• labs/lab7/k8s/networkpolicy.yaml — default-deny NetworkPolicy with explicit ingress (localhost/ingress controller) and egress (DNS + HTTPS) rules
• labs/lab7/policies/pod-hardening.rego — Conftest/Rego policy gating runAsNonRoot, readOnlyRootFilesystem, allowPrivilegeEscalation, and capabilities.drop: ["ALL"]
• submissions/lab7.md — full write-up: Trivy image scan results, top-10 fixable CVEs, Grype comparison, K8s hardening docs, Trivy k8s scan, readOnlyRootFilesystem debugging story, Conftest bonus results

Testing

# Trivy image scan
trivy image bkimminich/juice-shop:v20.0.0 --severity HIGH,CRITICAL --format table
# -> 10 CRITICAL, 86 HIGH (96 total, 80 with fix available)

# K8s cluster + hardened deployment
kind create cluster --name lab7 --image kindest/node:v1.33.0
kubectl apply -f labs/lab7/k8s/
kubectl -n juice-shop wait --for=condition=ready pod -l app=juice-shop --timeout=300s
kubectl -n juice-shop get pod -l app=juice-shop
# -> juice-shop-77965bd48d-kxjxz   1/1   Running   0   2m6s

# Trivy k8s scan
trivy k8s --include-namespaces juice-shop --severity HIGH,CRITICAL --report=summary
# -> 10 CRITICAL, 86 HIGH (image CVEs only; 0 K8s misconfigurations)

# Conftest — hardened manifest (should pass)
conftest test labs/lab7/k8s/deployment.yaml --policy labs/lab7/policies
# -> 4 tests, 4 passed, 0 warnings, 0 failures, 0 exceptions

# Conftest — intentionally bad manifest (should fail)
conftest test /tmp/bad-pod.yaml --policy labs/lab7/policies
# -> 4 tests, 0 passed, 0 warnings, 4 failures, 0 exceptions

Artifacts & Screenshots

• submissions/lab7.md
• labs/lab7/k8s/namespace.yaml
• labs/lab7/k8s/serviceaccount.yaml
• labs/lab7/k8s/deployment.yaml
• labs/lab7/k8s/networkpolicy.yaml
• labs/lab7/policies/pod-hardening.rego

---

Checklist

• Title follows feat(labN): <topic> style
• No secrets or large temp files committed
• Submission file exists at submissions/lab7.md