Summary

This PR applies one focused, reviewable Zero Trust hardening pass to the bankapp Kubernetes deployment (the actual EKS attack surface) and wires a policy-as-code gate into CI so the controls cannot silently regress.

Note on scope: the task referenced Terraform IaC, but this repo contains no Terraform — the IaC is the raw manifests in kubernetes/ plus a Helm chart in helm/, and CI is a Jenkins pipeline (Jenkinsfile) that calls a private Shared library (not in-repo, so it can't be run/validated here). The hardening therefore targets the Kubernetes manifests that are actually deployed via the GitOps CD pipeline.

Three controls, each with a regression gate:

1. Hardened pod/container securityContext on bankapp and mysql deployments.
2. NetworkPolicies — namespace default-deny ingress + least-privilege allows.
3. Policy-as-code (Conftest/OPA) + Trivy IaC scan in a new GitHub Actions workflow.

Controls added → threat mitigated

Key implementation details

readOnlyRootFilesystem requires explicit writable mounts. The app only needs /tmp (JVM + embedded Tomcat scratch). MySQL additionally needs writable runtime dirs, mounted as emptyDir:

# bankapp
securityContext: {readOnlyRootFilesystem: true, ...}
volumeMounts: [{name: tmp, mountPath: /tmp}]
volumes: [{name: tmp, emptyDir: {}}]

# mysql (runs as uid/gid 999, the official image's mysql user)
volumeMounts: [/var/lib/mysql(PVC), /var/run/mysqld, /tmp, /var/lib/mysql-files]

The Conftest policy (policy/kubernetes-security.rego) enforces the container/pod controls per-document; policy/networkpolicy.rego runs in --combine mode to assert a default-deny ingress NetworkPolicy exists. Both have unit tests (*_test.rego).

Verification evidence (run locally)

Trivy IaC config scan (--severity HIGH,CRITICAL) on the two deployments:

BEFORE (origin/DevOps): 6 HIGH findings
  KSV-0118 default security context (bankapp + mysql, pod & container)
  KSV-0014 readOnlyRootFilesystem not set (bankapp + mysql)
AFTER  (this branch):   0 findings   ->  trivy config ... --exit-code 1  = pass

Conftest gate correctly fails closed on the un-hardened manifests and passes on the hardened ones:

$ conftest test /tmp/before/*.yml --policy policy
12 tests, 2 passed, 10 failures        # original manifests are rejected

$ conftest verify --policy policy                                  # 6 tests passed
$ conftest test kubernetes/bankapp-deployment.yml kubernetes/mysql-deployment.yml --policy policy   # 12 passed
$ conftest test --combine kubernetes/ --namespace netpol --policy policy                            # 1 passed
$ kubeconform -strict -ignore-missing-schemas kubernetes/                                           # Valid: 14/14

The same Conftest + Trivy commands run on every PR via the new IaC Security workflow.

Not in scope (follow-ups)

• Mirroring the same controls into the helm/ chart templates.
• Replacing the deprecated openjdk:17-alpine base image and remediating image-layer CVEs (the new Trivy gate makes these visible for a focused follow-up).
• Runtime validation on a live EKS cluster (manifests are schema- and policy-validated; no cluster was available in this environment).

Link to Devin session: https://app.devin.ai/sessions/4313fb49ecd0461a9ffadd6e9a4caa08
Requested by: @achalc

Devin Review

Run Devin Review

💡 Connect your GitHub account to enable automatic code reviews.