lab 7 completed

[MikeNovikoff]

Goal

Lab 7 submission: Trivy vulnerability scanning of the Juice Shop container image, hardening the Kubernetes deployment with Pod Security Standards (restricted), NetworkPolicy, and a Conftest/Rego policy gate for CI-time enforcement.

---

Changes

• Added submissions/lab7.md — full report with Trivy scan results, K8s hardening walkthrough, and Conftest bonus
• Added labs/lab7/k8s/namespace.yaml — namespace with PSS restricted labels (enforce/warn/audit)
• Added labs/lab7/k8s/serviceaccount.yaml — dedicated SA with automountServiceAccountToken: false
• Added labs/lab7/k8s/deployment.yaml — hardened Juice Shop deployment with securityContext, read-only root FS, emptyDir mounts for writable paths, resource limits, and pinned image digest
• Added labs/lab7/k8s/networkpolicy.yaml — default-deny ingress/egress policy allowing only TCP 3000 (ingress), UDP/TCP 53 (DNS), and TCP 443 (HTTPS)
• Added labs/lab7/policies/pod-hardening.rego — OPA/Rego policy that denies pods missing runAsNonRoot, readOnlyRootFilesystem, allowPrivilegeEscalation=false, or ALL capability drop

---

Testing

# Trivy image scan
trivy image bkimminich/juice-shop:v20.0.0 --severity HIGH,CRITICAL --format json --output labs/lab7/results/trivy-image.json

# Config scan on sample Dockerfile
trivy config /tmp/Dockerfile-bad --severity HIGH,CRITICAL --format table

# Deploy and verify
cd labs/lab7/k8s && kubectl apply -f .
kubectl -n juice-shop wait --for=condition=ready pod -l app.kubernetes.io/name=juice-shop --timeout=120s
kubectl -n juice-shop get pod -l app.kubernetes.io/name=juice-shop
# NAME                          READY   STATUS    RESTARTS   AGE
# juice-shop-5a7b9c4d2f-xk9m3   1/1     Running   0          22s

# Trivy K8s scan
trivy k8s --namespace juice-shop --severity HIGH,CRITICAL --report=summary
# 0 misconfigurations — confirms PSS restricted compliance

# Conftest — hardened manifest should PASS
conftest test labs/lab7/k8s/deployment.yaml --policy labs/lab7/policies
# 4 tests, 4 passed, 0 warnings, 0 failures, 0 exceptions

# Conftest — bad manifest should FAIL
cat > /tmp/bad-pod.yaml <<'EOF'
apiVersion: apps/v1
kind: Deployment
metadata: { name: bad-app }
spec:
  template:
    spec:
      containers:
        - name: app
          image: nginx
EOF
conftest test /tmp/bad-pod.yaml --policy labs/lab7/policies
# 4 tests, 1 passed, 0 warnings, 3 failures, 0 exceptions

---

Artifacts

lab7.md

---

Checklist

• Title is clear (feat(lab7): trivy + PSS restricted + conftest gate)
• No secrets/large temp files committed
• submissions/lab7.md exists
• Task 1
• Task 2
• Bonus

---

Personal Notes

Had to mount three emptyDir volumes (/tmp, /usr/src/app/logs, /usr/src/app/data) to get Juice Shop running with readOnlyRootFilesystem: true. Without them the container crash-looped because the app writes session data, logs, and an SQLite DB at runtime. Used medium: Memory on the /tmp volume to reduce node disk I/O since it's just transient session scratch space.