Pull Request Template

Goal

Complete Lab 7 container security submission with Trivy image and Kubernetes scanning, Pod Security Standards hardening, and a Conftest policy gate.

Changes

• submissions/lab7.md — completed submission with Task 1 (Trivy image scan), Task 2 (Kubernetes hardening), and the bonus Conftest policy section
• labs/lab7/k8s/namespace.yaml — added restricted Pod Security Standards labels
• labs/lab7/k8s/serviceaccount.yaml — added a dedicated service account with token automount disabled
• labs/lab7/k8s/deployment.yaml — hardened the Juice Shop deployment with non-root execution, read-only root filesystem, dropped capabilities, seccomp, resource requests/limits, and writable emptyDir mounts for runtime paths
• labs/lab7/k8s/networkpolicy.yaml — added ingress/egress restrictions for the workload
• labs/lab7/policies/pod-hardening.rego — added a Rego policy to block insecure pod definitions in CI

Testing

• Applied the manifests with kubectl apply -f labs/lab7/k8s/
• Verified the pod reached a healthy state: ready=true phase=Running restarts=0
• Ran conftest test labs/lab7/k8s/deployment.yaml --policy labs/lab7/policies/pod-hardening.rego and got 4 tests, 4 passed, 0 warnings, 0 failures, 0 exceptions
• Ran Trivy Kubernetes scan via Docker and observed 20 critical and 172 high findings in the juice-shop namespace

Artifacts & Screenshots

• submissions/lab7.md — final submission report

• labs/lab7/results/trivy-image.txt — Trivy image scan output

• labs/lab7/results/trivy-image.json — structured Trivy image scan results

• labs/lab7/results/conftest-good.txt — passing Conftest output

• labs/lab7/results/pod-spec.yaml — captured pod spec

• labs/lab7/results/pod-status.txt — pod status evidence

• labs/lab7/results/pod-describe.txt — pod describe output

• Title uses feat(lab7): <topic> style

• No secrets/large temp files committed

• submissions/lab7.md present

• Task 1 — Trivy image + config scans + Grype comparison

• Task 2 — Hardened K8s deployment with PSS restricted + NetworkPolicy

• Bonus — Conftest policy passing on hardened + failing on bad manifest