feat(lab7): trivy + PSS restricted + conftest gate

[Philip-78]

Goal

Scan Juice Shop with Trivy (image + Dockerfile misconfig), deploy to K8s with PSS restricted hardening, and write a Conftest policy to gate non-compliant pods.

Changes

• labs/lab7/k8s/ — namespace (PSS restricted), serviceaccount, hardened deployment, networkpolicy
• labs/lab7/policies/pod-hardening.rego — Conftest policy gating runAsNonRoot, readOnlyRootFilesystem, allowPrivilegeEscalation, capabilities
• submissions/lab7.md — Trivy scan results, K8s hardening proof, Conftest output

Testing

• Trivy image: 5 Critical, 43 High (46 with fixes available)
• Dockerfile misconfig: 4 findings including HIGH (USER root)
• Pod running 1/1 in juice-shop namespace with PSS restricted enforced
• Trivy K8s: 5C/43H vulns (image-level), 0 misconfigs on hardened manifest
• Conftest PASS on hardened deployment, FAIL on bad manifest (2 deny messages)

Artifacts

• submissions/lab7.md — full analysis

---

• Task 1 — Trivy image + config scans + Grype comparison
• Task 2 — Hardened K8s deployment with PSS restricted + NetworkPolicy
• Bonus — Conftest policy passing on hardened + failing on bad manifest