Feature/lab7

[sedimentt]

Goal

Scan the Juice Shop image and a sample Dockerfile with Trivy, run Juice Shop in k3d under the restricted Pod Security Standard, and make it run with a read-only root filesystem.

Changes

• `submissions/lab7. 2 and the Bonus
• labs/lab7/k8s/namespace.yaml — juice-shop namespace with enforce / warn /
• labs/lab7/k8s/serviceaccount.yaml — dedicated ServiceAccount`automountServiceAcc
• labs/lab7/k8s/deployment.yaml — image pinned by digest, runsUID 65532, seccomp ``, requests/limits,readOnlyRootFilesystem: true, emptyDir volumes plus a `seed` initContainer
• labs/lab7/k8s/service.yaml — ClusterIP service on port 3000 - labs/lab7/k8s/netny for Ingress andEgress; ingress only from Traefik on TCP 3000, egress only DNS tkube-dns ## Testing - trivy image bkimmverity HIGH,CRITICAL→ 11 CRITICAL / 74 HIGH; 77 of 85 have a fix -trivy configon lures:DS-0002(HIGH), DS-0001, DS-0004, DS-0026 -kubectl -n juice-dy pod -lapp=juice-shop→1/1 Running, 0 restarts - The process runs a CapEff: 0,NoNewPrivs: 1, Seccomp: 2, and no ServiceAccount token mount- kubectl run --dryod spec → rejected:violates PodSecurity "restricted:latest" - NetworkPolicy: reqspace to the app areblocked; egress from the app pod to 1.1.1.1:443 is refused; in-cluster DNS works
• trivy k8s HIGH misconfigurations: juice-plain 3 → juice-s(all severities: 16 e the same becausethe image is the same - Bonus: under readites to the root FSfail with EROFS and writes to the volumes succeed. Through port-forward, /,le and/ftp/legal.md` all return HTTP 200

Artifacts & Screenshots

• Report: submissions/lab7.md - Manifests: `labs/l
• Scan outputs (trivy-image.json, trivy-k8s.json, pod-spec.are in labs/lab7/rey for Lab 10 and are not committed, per .gitignore

Checklist

• Title is clear (feat(lab7): trivy scans + PSS restricted deployment)
• No secrets/large temp files committed
• Submission filists