We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
CKV_K8S_31 failure with DockerDefault configured
**Describe the bug**
CKV_K8S_31 failure when the seccompProfile type is configured as Docker/Default or Runtime/Default

**To Reproduce**
Define security context as below.

```
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: clust3rf8ck
  name: clust3rf8ck
  namespace: clust3rf8ck
spec:
  replicas: 2
  selector:
    matchLabels:
      app: clust3rf8ck
  strategy: {}
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: clust3rf8ck
      annotations:
        seccomp.security.alpha.kubernetes.io/pod: "docker/default"
    spec:
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchExpressions:
                  - key: app
                    operator: In
                    values:
                      - clust3rf8ck
              topologyKey: "kubernetes.io/hostname"
      containers:
        - image: eurogig/clust3rf8ck@sha256:a374eb5853e0e17d06bcf37afc2fcb40892aa3477caf362ea3581c71373cb90a
          name: clust3rf8ck
          imagePullPolicy: Always
          resources:
            limits:
              cpu: "1"
              memory: "200Mi"
            requests:
              cpu: "0.6"
              memory: "100Mi"
          livenessProbe:
            exec:
              command:
                - /bin/sh
                - -c
                - "[ -f /var/run/nginx.pid ] && ps -A | grep nginx"
            initialDelaySeconds: 10
            periodSeconds: 5
          readinessProbe:
            httpGet:
              scheme: HTTP
              path: /index.html
              port: 8080
            initialDelaySeconds: 10
            periodSeconds: 5
          securityContext:
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
                - NET_RAW
          volumeMounts:
            - mountPath: /var/cache/nginx
              name: cache-volume
            - mountPath: /var/run
              name: pid-volume
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 10014
        runAsGroup: 10014
      volumes:
        - name: cache-volume
          emptyDir: {}
        - name: pid-volume
          emptyDir: {}
status: {}
---
apiVersion: v1
kind: Service
metadata:
  creationTimestamp: null
  labels:
    app: clust3rf8ck
  name: cflb
  namespace: clust3rf8ck
spec:
  ports:
    - name: 80-80
      port: 80
      protocol: TCP
      targetPort: 8080
  selector:
    app: clust3rf8ck
  type: LoadBalancer
```
2. Run checkov for kubernetes.
```
checkov --framework=kubernetes --quiet -d .
```
**Expected behavior**
CKV_K8S_31 to pass with the following configuration.

```
spec:
  replicas: 2
  selector:
    matchLabels:
      app: clust3rf8ck
  strategy: {}
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: clust3rf8ck
      annotations:
        seccomp.security.alpha.kubernetes.io/pod: "docker/default"
```

**Actual Behaviour**
```
[terraformpipeline] checkov --framework=kubernetes --quiet -d .                                                                               20:52:07  ☁  master ☂ ⚡
kubernetes scan results:

Passed checks: 89, Failed checks: 1, Skipped checks: 0

Check: CKV_K8S_31: "Ensure that the seccomp profile is set to docker/default or runtime/default"
	FAILED for resource: Deployment.clust3rf8ck.clust3rf8ck
	File: /k8s-sample.yaml:35-114
	Guide: https://docs.bridgecrew.io/docs/bc_k8s_29

		35  | apiVersion: apps/v1
		36  | kind: Deployment
		37  | metadata:
		38  |   labels:
		39  |     app: clust3rf8ck
		40  |   name: clust3rf8ck
		41  |   namespace: clust3rf8ck
		42  | spec:
		43  |   replicas: 2
		44  |   selector:
		45  |     matchLabels:
		46  |       app: clust3rf8ck
		47  |   strategy: {}
		48  |   template:
		49  |     metadata:
		50  |       creationTimestamp: null
		51  |       labels:
		52  |         app: clust3rf8ck
		53  |       annotations:
		54  |         seccomp.security.alpha.kubernetes.io/pod: "docker/default"
		55  |     spec:
		56  |       affinity:
		57  |         podAntiAffinity:
		58  |           requiredDuringSchedulingIgnoredDuringExecution:
		59  |             - labelSelector:
		60  |                 matchExpressions:
		61  |                   - key: app
		62  |                     operator: In
		63  |                     values:
		64  |                       - clust3rf8ck
		65  |               topologyKey: "kubernetes.io/hostname"
		66  |       containers:
		67  |         - image: eurogig/clust3rf8ck@sha256:a374eb5853e0e17d06bcf37afc2fcb40892aa3477caf362ea3581c71373cb90a
		68  |           name: clust3rf8ck
		69  |           imagePullPolicy: Always
		70  |           resources:
		71  |             limits:
		72  |               cpu: "1"
		73  |               memory: "200Mi"
		74  |             requests:
		75  |               cpu: "0.6"
		76  |               memory: "100Mi"
		77  |           livenessProbe:
		78  |             exec:
		79  |               command:
		80  |                 - /bin/sh
		81  |                 - -c
		82  |                 - "[ -f /var/run/nginx.pid ] && ps -A | grep nginx"
		83  |             initialDelaySeconds: 10
		84  |             periodSeconds: 5
		85  |           readinessProbe:
		86  |             httpGet:
		87  |               scheme: HTTP
		88  |               path: /index.html
		89  |               port: 8080
		90  |             initialDelaySeconds: 10
		91  |             periodSeconds: 5
		92  |           securityContext:
		93  |             readOnlyRootFilesystem: true
		94  |             allowPrivilegeEscalation: false
		95  |             capabilities:
		96  |               drop:
		97  |                 - ALL
		98  |                 - NET_RAW
		99  |           volumeMounts:
		100 |             - mountPath: /var/cache/nginx
		101 |               name: cache-volume
		102 |             - mountPath: /var/run
		103 |               name: pid-volume
		104 |       automountServiceAccountToken: false
		105 |       securityContext:
		106 |         runAsNonRoot: true
		107 |         runAsUser: 10014
		108 |         runAsGroup: 10014
		109 |       volumes:
		110 |         - name: cache-volume
		111 |           emptyDir: {}
		112 |         - name: pid-volume
		113 |           emptyDir: {}
		114 | status: {}
```


**Desktop (please complete the following information):**
 - OS: Big Sur 11.5.2 
 - Checkov Version 2.0.479

**Additional context**
Took the K8s example from this blog https://bridgecrew.io/blog/creating-a-secure-kubernetes-nginx-deployment-using-checkov/


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `checkov/kubernetes/checks/Seccomp.py`
Content:
```
1 from checkov.common.models.enums import CheckCategories, CheckResult
2 from checkov.common.util.data_structures_utils import find_in_dict
3 from checkov.kubernetes.base_spec_check import BaseK8Check
4 from checkov.common.util.type_forcers import force_list
5 
6 
7 class Seccomp(BaseK8Check):
8 
9     def __init__(self):
10         # CIS-1.5 5.7.2
11         name = "Ensure that the seccomp profile is set to docker/default or runtime/default"
12         id = "CKV_K8S_31"
13         # Location: Pod.metadata.annotations.seccomp.security.alpha.kubernetes.io/pod
14         # Location: CronJob.spec.jobTemplate.spec.template.metadata.annotations.seccomp.security.alpha.kubernetes.io/pod
15         # Location: *.spec.template.metadata.annotations.seccomp.security.alpha.kubernetes.io/pod
16         # Location: *.spec.securityContext.seccompProfile.type
17         supported_kind = ['Pod', 'Deployment', 'DaemonSet', 'StatefulSet', 'ReplicaSet', 'ReplicationController', 'Job', 'CronJob']
18         categories = [CheckCategories.KUBERNETES]
19         super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind)
20 
21     def get_resource_id(self, conf):
22         if "namespace" in conf["metadata"]:
23             return "{}.{}.{}".format(conf["kind"], conf["metadata"]["name"], conf["metadata"]["namespace"])
24         else:
25             return "{}.{}.default".format(conf["kind"], conf["metadata"]["name"])
26 
27     def scan_spec_conf(self, conf):
28         metadata = {}
29 
30         if conf['kind'] == 'Pod':
31             security_profile = find_in_dict(conf, 'spec/securityContext/seccompProfile/type')
32             if security_profile:
33                 return CheckResult.PASSED if security_profile == 'RuntimeDefault' else CheckResult.FAILED
34             if "metadata" in conf:
35                 metadata = conf["metadata"]
36         if conf['kind'] == 'Deployment' or conf['kind'] == 'StatefulSet':
37             security_profile = find_in_dict(conf, 'spec/template/spec/securityContext/seccompProfile/type')
38             if security_profile:
39                 return CheckResult.PASSED if security_profile == 'RuntimeDefault' else CheckResult.FAILED
40             if "metadata" in conf:
41                 metadata = conf["metadata"]
42         elif conf['kind'] == 'CronJob':
43             if "spec" in conf:
44                 if "jobTemplate" in conf["spec"]:
45                     if "spec" in conf["spec"]["jobTemplate"]:
46                         if "template" in conf["spec"]["jobTemplate"]["spec"]:
47                             if "metadata" in conf["spec"]["jobTemplate"]["spec"]["template"]:
48                                 metadata = conf["spec"]["jobTemplate"]["spec"]["template"]["metadata"]
49         else:
50             inner_metadata = self.get_inner_entry(conf, "metadata")
51             metadata = inner_metadata if inner_metadata else metadata
52 
53         if metadata:
54             if metadata.get('annotations'):
55                 for annotation in force_list(metadata["annotations"]):
56                     for key in annotation:
57                         if "seccomp.security.alpha.kubernetes.io/pod" in key:
58                             if "docker/default" in annotation[key] or "runtime/default" in annotation[key]:
59                                 return CheckResult.PASSED
60         return CheckResult.FAILED
61 
62 
63 check = Seccomp()
64
```

Path: `checkov/kubernetes/base_spec_check.py`
Content:
```
1 from abc import abstractmethod
2 
3 from checkov.common.checks.base_check import BaseCheck
4 from checkov.common.multi_signature import multi_signature
5 from checkov.kubernetes.registry import registry
6 
7 
8 class BaseK8Check(BaseCheck):
9     def __init__(self, name, id, categories, supported_entities):
10         super().__init__(name=name, id=id, categories=categories, supported_entities=supported_entities,
11                          block_type="k8")
12         self.supported_specs = supported_entities
13         registry.register(self)
14 
15     @abstractmethod
16     def get_resource_id(self, conf):
17         pass
18 
19     def scan_entity_conf(self, conf, entity_type):
20         return self.scan_spec_conf(conf, entity_type)
21 
22     @multi_signature()
23     @abstractmethod
24     def scan_spec_conf(self, conf, entity_type):
25         raise NotImplementedError()
26 
27     @classmethod
28     @scan_spec_conf.add_signature(args=["self", "conf"])
29     def _scan_spec_conf_self_conf(cls, wrapped):
30         def wrapper(self, conf, entity_type=None):
31             # keep default argument for entity_type so old code, that doesn't set it, will work.
32             return wrapped(self, conf)
33 
34         return wrapper
35 
36     @staticmethod
37     def get_inner_entry(conf, entry_name):
38         spec = {}
39         if conf.get("spec") and conf.get("spec").get("template"):
40             spec = conf.get("spec").get("template").get(entry_name, {})
41         return spec
42
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/checkov/kubernetes/base_spec_check.py b/checkov/kubernetes/base_spec_check.py
--- a/checkov/kubernetes/base_spec_check.py
+++ b/checkov/kubernetes/base_spec_check.py
@@ -1,4 +1,5 @@
 from abc import abstractmethod
+from typing import Dict, Any
 
 from checkov.common.checks.base_check import BaseCheck
 from checkov.common.multi_signature import multi_signature
@@ -34,7 +35,7 @@
         return wrapper
 
     @staticmethod
-    def get_inner_entry(conf, entry_name):
+    def get_inner_entry(conf: Dict[str, Any], entry_name: str) -> Dict[str, Any]:
         spec = {}
         if conf.get("spec") and conf.get("spec").get("template"):
             spec = conf.get("spec").get("template").get(entry_name, {})
diff --git a/checkov/kubernetes/checks/Seccomp.py b/checkov/kubernetes/checks/Seccomp.py
--- a/checkov/kubernetes/checks/Seccomp.py
+++ b/checkov/kubernetes/checks/Seccomp.py
@@ -37,7 +37,9 @@
             security_profile = find_in_dict(conf, 'spec/template/spec/securityContext/seccompProfile/type')
             if security_profile:
                 return CheckResult.PASSED if security_profile == 'RuntimeDefault' else CheckResult.FAILED
-            if "metadata" in conf:
+
+            metadata = self.get_inner_entry(conf, "metadata")
+            if not metadata and "metadata" in conf:
                 metadata = conf["metadata"]
         elif conf['kind'] == 'CronJob':
             if "spec" in conf:

{"golden_diff": "diff --git a/checkov/kubernetes/base_spec_check.py b/checkov/kubernetes/base_spec_check.py\n--- a/checkov/kubernetes/base_spec_check.py\n+++ b/checkov/kubernetes/base_spec_check.py\n@@ -1,4 +1,5 @@\n from abc import abstractmethod\n+from typing import Dict, Any\n \n from checkov.common.checks.base_check import BaseCheck\n from checkov.common.multi_signature import multi_signature\n@@ -34,7 +35,7 @@\n         return wrapper\n \n     @staticmethod\n-    def get_inner_entry(conf, entry_name):\n+    def get_inner_entry(conf: Dict[str, Any], entry_name: str) -> Dict[str, Any]:\n         spec = {}\n         if conf.get(\"spec\") and conf.get(\"spec\").get(\"template\"):\n             spec = conf.get(\"spec\").get(\"template\").get(entry_name, {})\ndiff --git a/checkov/kubernetes/checks/Seccomp.py b/checkov/kubernetes/checks/Seccomp.py\n--- a/checkov/kubernetes/checks/Seccomp.py\n+++ b/checkov/kubernetes/checks/Seccomp.py\n@@ -37,7 +37,9 @@\n             security_profile = find_in_dict(conf, 'spec/template/spec/securityContext/seccompProfile/type')\n             if security_profile:\n                 return CheckResult.PASSED if security_profile == 'RuntimeDefault' else CheckResult.FAILED\n-            if \"metadata\" in conf:\n+\n+            metadata = self.get_inner_entry(conf, \"metadata\")\n+            if not metadata and \"metadata\" in conf:\n                 metadata = conf[\"metadata\"]\n         elif conf['kind'] == 'CronJob':\n             if \"spec\" in conf:\n", "issue": "CKV_K8S_31 failure with DockerDefault configured\n**Describe the bug**\r\nCKV_K8S_31 failure when the seccompProfile type is configured as Docker/Default or Runtime/Default\r\n\r\n**To Reproduce**\r\nDefine security context as below.\r\n\r\n```\r\napiVersion: apps/v1\r\nkind: Deployment\r\nmetadata:\r\n  labels:\r\n    app: clust3rf8ck\r\n  name: clust3rf8ck\r\n  namespace: clust3rf8ck\r\nspec:\r\n  replicas: 2\r\n  selector:\r\n    matchLabels:\r\n      app: clust3rf8ck\r\n  strategy: {}\r\n  template:\r\n    metadata:\r\n      creationTimestamp: null\r\n      labels:\r\n        app: clust3rf8ck\r\n      annotations:\r\n        seccomp.security.alpha.kubernetes.io/pod: \"docker/default\"\r\n    spec:\r\n      affinity:\r\n        podAntiAffinity:\r\n          requiredDuringSchedulingIgnoredDuringExecution:\r\n            - labelSelector:\r\n                matchExpressions:\r\n                  - key: app\r\n                    operator: In\r\n                    values:\r\n                      - clust3rf8ck\r\n              topologyKey: \"kubernetes.io/hostname\"\r\n      containers:\r\n        - image: eurogig/clust3rf8ck@sha256:a374eb5853e0e17d06bcf37afc2fcb40892aa3477caf362ea3581c71373cb90a\r\n          name: clust3rf8ck\r\n          imagePullPolicy: Always\r\n          resources:\r\n            limits:\r\n              cpu: \"1\"\r\n              memory: \"200Mi\"\r\n            requests:\r\n              cpu: \"0.6\"\r\n              memory: \"100Mi\"\r\n          livenessProbe:\r\n            exec:\r\n              command:\r\n                - /bin/sh\r\n                - -c\r\n                - \"[ -f /var/run/nginx.pid ] && ps -A | grep nginx\"\r\n            initialDelaySeconds: 10\r\n            periodSeconds: 5\r\n          readinessProbe:\r\n            httpGet:\r\n              scheme: HTTP\r\n              path: /index.html\r\n              port: 8080\r\n            initialDelaySeconds: 10\r\n            periodSeconds: 5\r\n          securityContext:\r\n            readOnlyRootFilesystem: true\r\n            allowPrivilegeEscalation: false\r\n            capabilities:\r\n              drop:\r\n                - ALL\r\n                - NET_RAW\r\n          volumeMounts:\r\n            - mountPath: /var/cache/nginx\r\n              name: cache-volume\r\n            - mountPath: /var/run\r\n              name: pid-volume\r\n      automountServiceAccountToken: false\r\n      securityContext:\r\n        runAsNonRoot: true\r\n        runAsUser: 10014\r\n        runAsGroup: 10014\r\n      volumes:\r\n        - name: cache-volume\r\n          emptyDir: {}\r\n        - name: pid-volume\r\n          emptyDir: {}\r\nstatus: {}\r\n---\r\napiVersion: v1\r\nkind: Service\r\nmetadata:\r\n  creationTimestamp: null\r\n  labels:\r\n    app: clust3rf8ck\r\n  name: cflb\r\n  namespace: clust3rf8ck\r\nspec:\r\n  ports:\r\n    - name: 80-80\r\n      port: 80\r\n      protocol: TCP\r\n      targetPort: 8080\r\n  selector:\r\n    app: clust3rf8ck\r\n  type: LoadBalancer\r\n```\r\n2. Run checkov for kubernetes.\r\n```\r\ncheckov --framework=kubernetes --quiet -d .\r\n```\r\n**Expected behavior**\r\nCKV_K8S_31 to pass with the following configuration.\r\n\r\n```\r\nspec:\r\n  replicas: 2\r\n  selector:\r\n    matchLabels:\r\n      app: clust3rf8ck\r\n  strategy: {}\r\n  template:\r\n    metadata:\r\n      creationTimestamp: null\r\n      labels:\r\n        app: clust3rf8ck\r\n      annotations:\r\n        seccomp.security.alpha.kubernetes.io/pod: \"docker/default\"\r\n```\r\n\r\n**Actual Behaviour**\r\n```\r\n[terraformpipeline] checkov --framework=kubernetes --quiet -d .                                                                               20:52:07  \u2601  master \u2602 \u26a1\r\nkubernetes scan results:\r\n\r\nPassed checks: 89, Failed checks: 1, Skipped checks: 0\r\n\r\nCheck: CKV_K8S_31: \"Ensure that the seccomp profile is set to docker/default or runtime/default\"\r\n\tFAILED for resource: Deployment.clust3rf8ck.clust3rf8ck\r\n\tFile: /k8s-sample.yaml:35-114\r\n\tGuide: https://docs.bridgecrew.io/docs/bc_k8s_29\r\n\r\n\t\t35  | apiVersion: apps/v1\r\n\t\t36  | kind: Deployment\r\n\t\t37  | metadata:\r\n\t\t38  |   labels:\r\n\t\t39  |     app: clust3rf8ck\r\n\t\t40  |   name: clust3rf8ck\r\n\t\t41  |   namespace: clust3rf8ck\r\n\t\t42  | spec:\r\n\t\t43  |   replicas: 2\r\n\t\t44  |   selector:\r\n\t\t45  |     matchLabels:\r\n\t\t46  |       app: clust3rf8ck\r\n\t\t47  |   strategy: {}\r\n\t\t48  |   template:\r\n\t\t49  |     metadata:\r\n\t\t50  |       creationTimestamp: null\r\n\t\t51  |       labels:\r\n\t\t52  |         app: clust3rf8ck\r\n\t\t53  |       annotations:\r\n\t\t54  |         seccomp.security.alpha.kubernetes.io/pod: \"docker/default\"\r\n\t\t55  |     spec:\r\n\t\t56  |       affinity:\r\n\t\t57  |         podAntiAffinity:\r\n\t\t58  |           requiredDuringSchedulingIgnoredDuringExecution:\r\n\t\t59  |             - labelSelector:\r\n\t\t60  |                 matchExpressions:\r\n\t\t61  |                   - key: app\r\n\t\t62  |                     operator: In\r\n\t\t63  |                     values:\r\n\t\t64  |                       - clust3rf8ck\r\n\t\t65  |               topologyKey: \"kubernetes.io/hostname\"\r\n\t\t66  |       containers:\r\n\t\t67  |         - image: eurogig/clust3rf8ck@sha256:a374eb5853e0e17d06bcf37afc2fcb40892aa3477caf362ea3581c71373cb90a\r\n\t\t68  |           name: clust3rf8ck\r\n\t\t69  |           imagePullPolicy: Always\r\n\t\t70  |           resources:\r\n\t\t71  |             limits:\r\n\t\t72  |               cpu: \"1\"\r\n\t\t73  |               memory: \"200Mi\"\r\n\t\t74  |             requests:\r\n\t\t75  |               cpu: \"0.6\"\r\n\t\t76  |               memory: \"100Mi\"\r\n\t\t77  |           livenessProbe:\r\n\t\t78  |             exec:\r\n\t\t79  |               command:\r\n\t\t80  |                 - /bin/sh\r\n\t\t81  |                 - -c\r\n\t\t82  |                 - \"[ -f /var/run/nginx.pid ] && ps -A | grep nginx\"\r\n\t\t83  |             initialDelaySeconds: 10\r\n\t\t84  |             periodSeconds: 5\r\n\t\t85  |           readinessProbe:\r\n\t\t86  |             httpGet:\r\n\t\t87  |               scheme: HTTP\r\n\t\t88  |               path: /index.html\r\n\t\t89  |               port: 8080\r\n\t\t90  |             initialDelaySeconds: 10\r\n\t\t91  |             periodSeconds: 5\r\n\t\t92  |           securityContext:\r\n\t\t93  |             readOnlyRootFilesystem: true\r\n\t\t94  |             allowPrivilegeEscalation: false\r\n\t\t95  |             capabilities:\r\n\t\t96  |               drop:\r\n\t\t97  |                 - ALL\r\n\t\t98  |                 - NET_RAW\r\n\t\t99  |           volumeMounts:\r\n\t\t100 |             - mountPath: /var/cache/nginx\r\n\t\t101 |               name: cache-volume\r\n\t\t102 |             - mountPath: /var/run\r\n\t\t103 |               name: pid-volume\r\n\t\t104 |       automountServiceAccountToken: false\r\n\t\t105 |       securityContext:\r\n\t\t106 |         runAsNonRoot: true\r\n\t\t107 |         runAsUser: 10014\r\n\t\t108 |         runAsGroup: 10014\r\n\t\t109 |       volumes:\r\n\t\t110 |         - name: cache-volume\r\n\t\t111 |           emptyDir: {}\r\n\t\t112 |         - name: pid-volume\r\n\t\t113 |           emptyDir: {}\r\n\t\t114 | status: {}\r\n```\r\n\r\n\r\n**Desktop (please complete the following information):**\r\n - OS: Big Sur 11.5.2 \r\n - Checkov Version 2.0.479\r\n\r\n**Additional context**\r\nTook the K8s example from this blog https://bridgecrew.io/blog/creating-a-secure-kubernetes-nginx-deployment-using-checkov/\r\n\n", "before_files": [{"content": "from checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.common.util.data_structures_utils import find_in_dict\nfrom checkov.kubernetes.base_spec_check import BaseK8Check\nfrom checkov.common.util.type_forcers import force_list\n\n\nclass Seccomp(BaseK8Check):\n\n    def __init__(self):\n        # CIS-1.5 5.7.2\n        name = \"Ensure that the seccomp profile is set to docker/default or runtime/default\"\n        id = \"CKV_K8S_31\"\n        # Location: Pod.metadata.annotations.seccomp.security.alpha.kubernetes.io/pod\n        # Location: CronJob.spec.jobTemplate.spec.template.metadata.annotations.seccomp.security.alpha.kubernetes.io/pod\n        # Location: *.spec.template.metadata.annotations.seccomp.security.alpha.kubernetes.io/pod\n        # Location: *.spec.securityContext.seccompProfile.type\n        supported_kind = ['Pod', 'Deployment', 'DaemonSet', 'StatefulSet', 'ReplicaSet', 'ReplicationController', 'Job', 'CronJob']\n        categories = [CheckCategories.KUBERNETES]\n        super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind)\n\n    def get_resource_id(self, conf):\n        if \"namespace\" in conf[\"metadata\"]:\n            return \"{}.{}.{}\".format(conf[\"kind\"], conf[\"metadata\"][\"name\"], conf[\"metadata\"][\"namespace\"])\n        else:\n            return \"{}.{}.default\".format(conf[\"kind\"], conf[\"metadata\"][\"name\"])\n\n    def scan_spec_conf(self, conf):\n        metadata = {}\n\n        if conf['kind'] == 'Pod':\n            security_profile = find_in_dict(conf, 'spec/securityContext/seccompProfile/type')\n            if security_profile:\n                return CheckResult.PASSED if security_profile == 'RuntimeDefault' else CheckResult.FAILED\n            if \"metadata\" in conf:\n                metadata = conf[\"metadata\"]\n        if conf['kind'] == 'Deployment' or conf['kind'] == 'StatefulSet':\n            security_profile = find_in_dict(conf, 'spec/template/spec/securityContext/seccompProfile/type')\n            if security_profile:\n                return CheckResult.PASSED if security_profile == 'RuntimeDefault' else CheckResult.FAILED\n            if \"metadata\" in conf:\n                metadata = conf[\"metadata\"]\n        elif conf['kind'] == 'CronJob':\n            if \"spec\" in conf:\n                if \"jobTemplate\" in conf[\"spec\"]:\n                    if \"spec\" in conf[\"spec\"][\"jobTemplate\"]:\n                        if \"template\" in conf[\"spec\"][\"jobTemplate\"][\"spec\"]:\n                            if \"metadata\" in conf[\"spec\"][\"jobTemplate\"][\"spec\"][\"template\"]:\n                                metadata = conf[\"spec\"][\"jobTemplate\"][\"spec\"][\"template\"][\"metadata\"]\n        else:\n            inner_metadata = self.get_inner_entry(conf, \"metadata\")\n            metadata = inner_metadata if inner_metadata else metadata\n\n        if metadata:\n            if metadata.get('annotations'):\n                for annotation in force_list(metadata[\"annotations\"]):\n                    for key in annotation:\n                        if \"seccomp.security.alpha.kubernetes.io/pod\" in key:\n                            if \"docker/default\" in annotation[key] or \"runtime/default\" in annotation[key]:\n                                return CheckResult.PASSED\n        return CheckResult.FAILED\n\n\ncheck = Seccomp()\n", "path": "checkov/kubernetes/checks/Seccomp.py"}, {"content": "from abc import abstractmethod\n\nfrom checkov.common.checks.base_check import BaseCheck\nfrom checkov.common.multi_signature import multi_signature\nfrom checkov.kubernetes.registry import registry\n\n\nclass BaseK8Check(BaseCheck):\n    def __init__(self, name, id, categories, supported_entities):\n        super().__init__(name=name, id=id, categories=categories, supported_entities=supported_entities,\n                         block_type=\"k8\")\n        self.supported_specs = supported_entities\n        registry.register(self)\n\n    @abstractmethod\n    def get_resource_id(self, conf):\n        pass\n\n    def scan_entity_conf(self, conf, entity_type):\n        return self.scan_spec_conf(conf, entity_type)\n\n    @multi_signature()\n    @abstractmethod\n    def scan_spec_conf(self, conf, entity_type):\n        raise NotImplementedError()\n\n    @classmethod\n    @scan_spec_conf.add_signature(args=[\"self\", \"conf\"])\n    def _scan_spec_conf_self_conf(cls, wrapped):\n        def wrapper(self, conf, entity_type=None):\n            # keep default argument for entity_type so old code, that doesn't set it, will work.\n            return wrapped(self, conf)\n\n        return wrapper\n\n    @staticmethod\n    def get_inner_entry(conf, entry_name):\n        spec = {}\n        if conf.get(\"spec\") and conf.get(\"spec\").get(\"template\"):\n            spec = conf.get(\"spec\").get(\"template\").get(entry_name, {})\n        return spec\n", "path": "checkov/kubernetes/base_spec_check.py"}], "after_files": [{"content": "from checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.common.util.data_structures_utils import find_in_dict\nfrom checkov.kubernetes.base_spec_check import BaseK8Check\nfrom checkov.common.util.type_forcers import force_list\n\n\nclass Seccomp(BaseK8Check):\n\n    def __init__(self):\n        # CIS-1.5 5.7.2\n        name = \"Ensure that the seccomp profile is set to docker/default or runtime/default\"\n        id = \"CKV_K8S_31\"\n        # Location: Pod.metadata.annotations.seccomp.security.alpha.kubernetes.io/pod\n        # Location: CronJob.spec.jobTemplate.spec.template.metadata.annotations.seccomp.security.alpha.kubernetes.io/pod\n        # Location: *.spec.template.metadata.annotations.seccomp.security.alpha.kubernetes.io/pod\n        # Location: *.spec.securityContext.seccompProfile.type\n        supported_kind = ['Pod', 'Deployment', 'DaemonSet', 'StatefulSet', 'ReplicaSet', 'ReplicationController', 'Job', 'CronJob']\n        categories = [CheckCategories.KUBERNETES]\n        super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind)\n\n    def get_resource_id(self, conf):\n        if \"namespace\" in conf[\"metadata\"]:\n            return \"{}.{}.{}\".format(conf[\"kind\"], conf[\"metadata\"][\"name\"], conf[\"metadata\"][\"namespace\"])\n        else:\n            return \"{}.{}.default\".format(conf[\"kind\"], conf[\"metadata\"][\"name\"])\n\n    def scan_spec_conf(self, conf):\n        metadata = {}\n\n        if conf['kind'] == 'Pod':\n            security_profile = find_in_dict(conf, 'spec/securityContext/seccompProfile/type')\n            if security_profile:\n                return CheckResult.PASSED if security_profile == 'RuntimeDefault' else CheckResult.FAILED\n            if \"metadata\" in conf:\n                metadata = conf[\"metadata\"]\n        if conf['kind'] == 'Deployment' or conf['kind'] == 'StatefulSet':\n            security_profile = find_in_dict(conf, 'spec/template/spec/securityContext/seccompProfile/type')\n            if security_profile:\n                return CheckResult.PASSED if security_profile == 'RuntimeDefault' else CheckResult.FAILED\n\n            metadata = self.get_inner_entry(conf, \"metadata\")\n            if not metadata and \"metadata\" in conf:\n                metadata = conf[\"metadata\"]\n        elif conf['kind'] == 'CronJob':\n            if \"spec\" in conf:\n                if \"jobTemplate\" in conf[\"spec\"]:\n                    if \"spec\" in conf[\"spec\"][\"jobTemplate\"]:\n                        if \"template\" in conf[\"spec\"][\"jobTemplate\"][\"spec\"]:\n                            if \"metadata\" in conf[\"spec\"][\"jobTemplate\"][\"spec\"][\"template\"]:\n                                metadata = conf[\"spec\"][\"jobTemplate\"][\"spec\"][\"template\"][\"metadata\"]\n        else:\n            inner_metadata = self.get_inner_entry(conf, \"metadata\")\n            metadata = inner_metadata if inner_metadata else metadata\n\n        if metadata:\n            if metadata.get('annotations'):\n                for annotation in force_list(metadata[\"annotations\"]):\n                    for key in annotation:\n                        if \"seccomp.security.alpha.kubernetes.io/pod\" in key:\n                            if \"docker/default\" in annotation[key] or \"runtime/default\" in annotation[key]:\n                                return CheckResult.PASSED\n        return CheckResult.FAILED\n\n\ncheck = Seccomp()\n", "path": "checkov/kubernetes/checks/Seccomp.py"}, {"content": "from abc import abstractmethod\nfrom typing import Dict, Any\n\nfrom checkov.common.checks.base_check import BaseCheck\nfrom checkov.common.multi_signature import multi_signature\nfrom checkov.kubernetes.registry import registry\n\n\nclass BaseK8Check(BaseCheck):\n    def __init__(self, name, id, categories, supported_entities):\n        super().__init__(name=name, id=id, categories=categories, supported_entities=supported_entities,\n                         block_type=\"k8\")\n        self.supported_specs = supported_entities\n        registry.register(self)\n\n    @abstractmethod\n    def get_resource_id(self, conf):\n        pass\n\n    def scan_entity_conf(self, conf, entity_type):\n        return self.scan_spec_conf(conf, entity_type)\n\n    @multi_signature()\n    @abstractmethod\n    def scan_spec_conf(self, conf, entity_type):\n        raise NotImplementedError()\n\n    @classmethod\n    @scan_spec_conf.add_signature(args=[\"self\", \"conf\"])\n    def _scan_spec_conf_self_conf(cls, wrapped):\n        def wrapper(self, conf, entity_type=None):\n            # keep default argument for entity_type so old code, that doesn't set it, will work.\n            return wrapped(self, conf)\n\n        return wrapper\n\n    @staticmethod\n    def get_inner_entry(conf: Dict[str, Any], entry_name: str) -> Dict[str, Any]:\n        spec = {}\n        if conf.get(\"spec\") and conf.get(\"spec\").get(\"template\"):\n            spec = conf.get(\"spec\").get(\"template\").get(entry_name, {})\n        return spec\n", "path": "checkov/kubernetes/base_spec_check.py"}]}