feat(lab7): container security — Trivy + PSS restricted + Conftest

[Basinkse21]

Goal

Scan Juice Shop with Trivy (image + config), harden a K8s deployment to PSS restricted, and write a Conftest gate.

Changes

• submissions/lab7.md — Trivy findings, K8s hardening write-up, Conftest results
• labs/lab7/k8s/ — namespace (PSS restricted), serviceaccount, hardened deployment, networkpolicy
• labs/lab7/policies/pod-hardening.rego — Conftest policy

Testing

• Trivy image: 5 CRITICAL / 40 HIGH (43 fixable); Dockerfile config: 4 misconfigs (DS-0002 HIGH)
• Pod Running 1/1 under enforce=restricted; trivy k8s = 0 misconfigurations on the workload
• Conftest: PASS on hardened deployment, FAIL (4 deny) on bad manifest

---

Checklist

• Task 1 — Trivy image + config scans + Grype comparison
• Task 2 — Hardened K8s deployment with PSS restricted + NetworkPolicy
• Bonus — Conftest policy passing on hardened + failing on bad manifest