We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
BC_K8S_14/CKV_K8S_15 "Image Pull Policy should be Always" should not be reported when using a digest
**Describe the issue**
[BC_K8S_14/CKV_K8S_15 "Image Pull Policy should be Always"](https://docs.bridgecrew.io/docs/bc_k8s_14) should not be reported when using a digest.

Per the documentation:
>  When the imagePullPolicy is set to Always, you ensure the latest version of the image is deployed every time the pod is started.

By specifying the digest, the same image is always used, so there is no concern about the latest version (since the the version cannot change), negating the need to always pull the image.

**Examples**
Save the following as `deployment.yaml`:
```yaml
apiVersion: v1
kind: Pod
metadata:
  name: <name>
spec:
  containers:
    - name: nginx
      image: 'nginx@sha256:b0ad43f7ee5edbc0effbc14645ae7055e21bc1973aee5150745632a24a752661'
      imagePullPolicy: IfNotPresent
```
Run: `checkov --framework kubernetes -f deployment.yaml -c CKV_K8S_15`

Actual result:
FAILED

Expected result:
Passed

**Version (please complete the following information):**
 - Checkov Version 2.3.126

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py`
Content:
```
1 from checkov.common.models.enums import CheckCategories, CheckResult
2 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
3 
4 
5 class ImagePullPolicyAlways(BaseResourceCheck):
6 
7     def __init__(self):
8         """
9         Image pull policy should be set to always to ensure you get the correct image and imagePullSecrets are correct
10         Default is 'IfNotPresent' unless image tag is omitted or :latest
11         https://kubernetes.io/docs/concepts/configuration/overview/#container-images
12 
13         An admission controller could be used to enforce imagePullPolicy
14         """
15         name = "Image Pull Policy should be Always"
16         id = "CKV_K8S_15"
17         supported_resources = ["kubernetes_pod", "kubernetes_pod_v1",
18                                "kubernetes_deployment", "kubernetes_deployment_v1"]
19         categories = [CheckCategories.GENERAL_SECURITY]
20         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
21 
22     def scan_resource_conf(self, conf) -> CheckResult:
23         spec = conf.get('spec', [None])[0]
24         if isinstance(spec, dict) and spec:
25             evaluated_keys_path = "spec"
26 
27             template = spec.get("template")
28             if template and isinstance(template, list):
29                 template = template[0]
30                 template_spec = template.get("spec")
31                 if template_spec and isinstance(template_spec, list):
32                     spec = template_spec[0]
33                     evaluated_keys_path = f'{evaluated_keys_path}/[0]/template/[0]/spec'
34 
35             containers = spec.get("container")
36             if containers is None:
37                 return CheckResult.UNKNOWN
38             for idx, container in enumerate(containers):
39                 if not isinstance(container, dict):
40                     return CheckResult.UNKNOWN
41 
42                 if container.get("image_pull_policy"):
43                     if container.get("image_pull_policy")[0] == "Always":
44                         break
45                 else:
46                     if container.get("image"):
47                         name = container.get("image")[0]
48                         if "latest" in name:
49                             break
50                 self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]']
51                 return CheckResult.FAILED
52             return CheckResult.PASSED
53         return CheckResult.FAILED
54 
55 
56 check = ImagePullPolicyAlways()
57
```

Path: `checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py`
Content:
```
1 import re
2 from typing import Any, Dict
3 
4 from checkov.common.models.consts import DOCKER_IMAGE_REGEX
5 from checkov.common.models.enums import CheckResult
6 from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck
7 
8 
9 class ImagePullPolicyAlways(BaseK8sContainerCheck):
10     def __init__(self) -> None:
11         """
12         Image pull policy should be set to always to ensure you get the correct image and imagePullSecrets are correct
13         Default is 'IfNotPresent' unless image tag is omitted or :latest
14         https://kubernetes.io/docs/concepts/configuration/overview/#container-images
15 
16         An admission controller could be used to enforce imagePullPolicy
17         """
18         name = "Image Pull Policy should be Always"
19         id = "CKV_K8S_15"
20         # Location: container .imagePullPolicy
21         super().__init__(name=name, id=id)
22 
23     def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult:
24         self.evaluated_container_keys = ["image", "imagePullPolicy"]
25         if conf.get("image"):
26             # Remove the digest, if present
27             image_val = conf["image"]
28             if not isinstance(image_val, str) or image_val.strip() == "":
29                 return CheckResult.UNKNOWN
30             if "@" in image_val:
31                 image_val = image_val[0 : image_val.index("@")]
32             if "imagePullPolicy" not in conf:
33                 image_tag_match = re.findall(DOCKER_IMAGE_REGEX, image_val)
34                 if len(image_tag_match) != 1:
35                     # If image name is invalid, check result can not be determined
36                     return CheckResult.UNKNOWN
37                 (image, tag) = image_tag_match[0]
38                 if tag == "latest" or tag == "":
39                     # Default imagePullPolicy = Always
40                     return CheckResult.PASSED
41                 else:
42                     # Default imagePullPolicy = IfNotPresent
43                     return CheckResult.FAILED
44             else:
45                 if conf["imagePullPolicy"] != "Always":
46                     return CheckResult.FAILED
47 
48         else:
49             return CheckResult.FAILED
50         return CheckResult.PASSED
51 
52 
53 check = ImagePullPolicyAlways()
54
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py b/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py
--- a/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py
+++ b/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py
@@ -29,6 +29,9 @@
                 return CheckResult.UNKNOWN
             if "@" in image_val:
                 image_val = image_val[0 : image_val.index("@")]
+                has_digest = True
+            else:
+                has_digest = False
             if "imagePullPolicy" not in conf:
                 image_tag_match = re.findall(DOCKER_IMAGE_REGEX, image_val)
                 if len(image_tag_match) != 1:
@@ -38,11 +41,13 @@
                 if tag == "latest" or tag == "":
                     # Default imagePullPolicy = Always
                     return CheckResult.PASSED
+                elif has_digest:
+                    return CheckResult.PASSED
                 else:
                     # Default imagePullPolicy = IfNotPresent
                     return CheckResult.FAILED
             else:
-                if conf["imagePullPolicy"] != "Always":
+                if not has_digest and conf["imagePullPolicy"] != "Always":
                     return CheckResult.FAILED
 
         else:
diff --git a/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py b/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py
--- a/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py
+++ b/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py
@@ -7,7 +7,7 @@
     def __init__(self):
         """
         Image pull policy should be set to always to ensure you get the correct image and imagePullSecrets are correct
-        Default is 'IfNotPresent' unless image tag is omitted or :latest
+        Default is 'IfNotPresent' unless image tag/digest is omitted or :latest
         https://kubernetes.io/docs/concepts/configuration/overview/#container-images
 
         An admission controller could be used to enforce imagePullPolicy
@@ -47,6 +47,8 @@
                         name = container.get("image")[0]
                         if "latest" in name:
                             break
+                        if "@" in name:
+                            break
                 self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]']
                 return CheckResult.FAILED
             return CheckResult.PASSED

{"golden_diff": "diff --git a/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py b/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py\n--- a/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py\n+++ b/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py\n@@ -29,6 +29,9 @@\n                 return CheckResult.UNKNOWN\n             if \"@\" in image_val:\n                 image_val = image_val[0 : image_val.index(\"@\")]\n+                has_digest = True\n+            else:\n+                has_digest = False\n             if \"imagePullPolicy\" not in conf:\n                 image_tag_match = re.findall(DOCKER_IMAGE_REGEX, image_val)\n                 if len(image_tag_match) != 1:\n@@ -38,11 +41,13 @@\n                 if tag == \"latest\" or tag == \"\":\n                     # Default imagePullPolicy = Always\n                     return CheckResult.PASSED\n+                elif has_digest:\n+                    return CheckResult.PASSED\n                 else:\n                     # Default imagePullPolicy = IfNotPresent\n                     return CheckResult.FAILED\n             else:\n-                if conf[\"imagePullPolicy\"] != \"Always\":\n+                if not has_digest and conf[\"imagePullPolicy\"] != \"Always\":\n                     return CheckResult.FAILED\n \n         else:\ndiff --git a/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py b/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py\n--- a/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py\n+++ b/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py\n@@ -7,7 +7,7 @@\n     def __init__(self):\n         \"\"\"\n         Image pull policy should be set to always to ensure you get the correct image and imagePullSecrets are correct\n-        Default is 'IfNotPresent' unless image tag is omitted or :latest\n+        Default is 'IfNotPresent' unless image tag/digest is omitted or :latest\n         https://kubernetes.io/docs/concepts/configuration/overview/#container-images\n \n         An admission controller could be used to enforce imagePullPolicy\n@@ -47,6 +47,8 @@\n                         name = container.get(\"image\")[0]\n                         if \"latest\" in name:\n                             break\n+                        if \"@\" in name:\n+                            break\n                 self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]']\n                 return CheckResult.FAILED\n             return CheckResult.PASSED\n", "issue": "BC_K8S_14/CKV_K8S_15 \"Image Pull Policy should be Always\" should not be reported when using a digest\n**Describe the issue**\r\n[BC_K8S_14/CKV_K8S_15 \"Image Pull Policy should be Always\"](https://docs.bridgecrew.io/docs/bc_k8s_14) should not be reported when using a digest.\r\n\r\nPer the documentation:\r\n>  When the imagePullPolicy is set to Always, you ensure the latest version of the image is deployed every time the pod is started.\r\n\r\nBy specifying the digest, the same image is always used, so there is no concern about the latest version (since the the version cannot change), negating the need to always pull the image.\r\n\r\n**Examples**\r\nSave the following as `deployment.yaml`:\r\n```yaml\r\napiVersion: v1\r\nkind: Pod\r\nmetadata:\r\n  name: <name>\r\nspec:\r\n  containers:\r\n    - name: nginx\r\n      image: 'nginx@sha256:b0ad43f7ee5edbc0effbc14645ae7055e21bc1973aee5150745632a24a752661'\r\n      imagePullPolicy: IfNotPresent\r\n```\r\nRun: `checkov --framework kubernetes -f deployment.yaml -c CKV_K8S_15`\r\n\r\nActual result:\r\nFAILED\r\n\r\nExpected result:\r\nPassed\r\n\r\n**Version (please complete the following information):**\r\n - Checkov Version 2.3.126\n", "before_files": [{"content": "from checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n\n\nclass ImagePullPolicyAlways(BaseResourceCheck):\n\n    def __init__(self):\n        \"\"\"\n        Image pull policy should be set to always to ensure you get the correct image and imagePullSecrets are correct\n        Default is 'IfNotPresent' unless image tag is omitted or :latest\n        https://kubernetes.io/docs/concepts/configuration/overview/#container-images\n\n        An admission controller could be used to enforce imagePullPolicy\n        \"\"\"\n        name = \"Image Pull Policy should be Always\"\n        id = \"CKV_K8S_15\"\n        supported_resources = [\"kubernetes_pod\", \"kubernetes_pod_v1\",\n                               \"kubernetes_deployment\", \"kubernetes_deployment_v1\"]\n        categories = [CheckCategories.GENERAL_SECURITY]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf) -> CheckResult:\n        spec = conf.get('spec', [None])[0]\n        if isinstance(spec, dict) and spec:\n            evaluated_keys_path = \"spec\"\n\n            template = spec.get(\"template\")\n            if template and isinstance(template, list):\n                template = template[0]\n                template_spec = template.get(\"spec\")\n                if template_spec and isinstance(template_spec, list):\n                    spec = template_spec[0]\n                    evaluated_keys_path = f'{evaluated_keys_path}/[0]/template/[0]/spec'\n\n            containers = spec.get(\"container\")\n            if containers is None:\n                return CheckResult.UNKNOWN\n            for idx, container in enumerate(containers):\n                if not isinstance(container, dict):\n                    return CheckResult.UNKNOWN\n\n                if container.get(\"image_pull_policy\"):\n                    if container.get(\"image_pull_policy\")[0] == \"Always\":\n                        break\n                else:\n                    if container.get(\"image\"):\n                        name = container.get(\"image\")[0]\n                        if \"latest\" in name:\n                            break\n                self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]']\n                return CheckResult.FAILED\n            return CheckResult.PASSED\n        return CheckResult.FAILED\n\n\ncheck = ImagePullPolicyAlways()\n", "path": "checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py"}, {"content": "import re\nfrom typing import Any, Dict\n\nfrom checkov.common.models.consts import DOCKER_IMAGE_REGEX\nfrom checkov.common.models.enums import CheckResult\nfrom checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck\n\n\nclass ImagePullPolicyAlways(BaseK8sContainerCheck):\n    def __init__(self) -> None:\n        \"\"\"\n        Image pull policy should be set to always to ensure you get the correct image and imagePullSecrets are correct\n        Default is 'IfNotPresent' unless image tag is omitted or :latest\n        https://kubernetes.io/docs/concepts/configuration/overview/#container-images\n\n        An admission controller could be used to enforce imagePullPolicy\n        \"\"\"\n        name = \"Image Pull Policy should be Always\"\n        id = \"CKV_K8S_15\"\n        # Location: container .imagePullPolicy\n        super().__init__(name=name, id=id)\n\n    def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult:\n        self.evaluated_container_keys = [\"image\", \"imagePullPolicy\"]\n        if conf.get(\"image\"):\n            # Remove the digest, if present\n            image_val = conf[\"image\"]\n            if not isinstance(image_val, str) or image_val.strip() == \"\":\n                return CheckResult.UNKNOWN\n            if \"@\" in image_val:\n                image_val = image_val[0 : image_val.index(\"@\")]\n            if \"imagePullPolicy\" not in conf:\n                image_tag_match = re.findall(DOCKER_IMAGE_REGEX, image_val)\n                if len(image_tag_match) != 1:\n                    # If image name is invalid, check result can not be determined\n                    return CheckResult.UNKNOWN\n                (image, tag) = image_tag_match[0]\n                if tag == \"latest\" or tag == \"\":\n                    # Default imagePullPolicy = Always\n                    return CheckResult.PASSED\n                else:\n                    # Default imagePullPolicy = IfNotPresent\n                    return CheckResult.FAILED\n            else:\n                if conf[\"imagePullPolicy\"] != \"Always\":\n                    return CheckResult.FAILED\n\n        else:\n            return CheckResult.FAILED\n        return CheckResult.PASSED\n\n\ncheck = ImagePullPolicyAlways()\n", "path": "checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py"}], "after_files": [{"content": "from checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n\n\nclass ImagePullPolicyAlways(BaseResourceCheck):\n\n    def __init__(self):\n        \"\"\"\n        Image pull policy should be set to always to ensure you get the correct image and imagePullSecrets are correct\n        Default is 'IfNotPresent' unless image tag/digest is omitted or :latest\n        https://kubernetes.io/docs/concepts/configuration/overview/#container-images\n\n        An admission controller could be used to enforce imagePullPolicy\n        \"\"\"\n        name = \"Image Pull Policy should be Always\"\n        id = \"CKV_K8S_15\"\n        supported_resources = [\"kubernetes_pod\", \"kubernetes_pod_v1\",\n                               \"kubernetes_deployment\", \"kubernetes_deployment_v1\"]\n        categories = [CheckCategories.GENERAL_SECURITY]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf) -> CheckResult:\n        spec = conf.get('spec', [None])[0]\n        if isinstance(spec, dict) and spec:\n            evaluated_keys_path = \"spec\"\n\n            template = spec.get(\"template\")\n            if template and isinstance(template, list):\n                template = template[0]\n                template_spec = template.get(\"spec\")\n                if template_spec and isinstance(template_spec, list):\n                    spec = template_spec[0]\n                    evaluated_keys_path = f'{evaluated_keys_path}/[0]/template/[0]/spec'\n\n            containers = spec.get(\"container\")\n            if containers is None:\n                return CheckResult.UNKNOWN\n            for idx, container in enumerate(containers):\n                if not isinstance(container, dict):\n                    return CheckResult.UNKNOWN\n\n                if container.get(\"image_pull_policy\"):\n                    if container.get(\"image_pull_policy\")[0] == \"Always\":\n                        break\n                else:\n                    if container.get(\"image\"):\n                        name = container.get(\"image\")[0]\n                        if \"latest\" in name:\n                            break\n                        if \"@\" in name:\n                            break\n                self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]']\n                return CheckResult.FAILED\n            return CheckResult.PASSED\n        return CheckResult.FAILED\n\n\ncheck = ImagePullPolicyAlways()\n", "path": "checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py"}, {"content": "import re\nfrom typing import Any, Dict\n\nfrom checkov.common.models.consts import DOCKER_IMAGE_REGEX\nfrom checkov.common.models.enums import CheckResult\nfrom checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck\n\n\nclass ImagePullPolicyAlways(BaseK8sContainerCheck):\n    def __init__(self) -> None:\n        \"\"\"\n        Image pull policy should be set to always to ensure you get the correct image and imagePullSecrets are correct\n        Default is 'IfNotPresent' unless image tag is omitted or :latest\n        https://kubernetes.io/docs/concepts/configuration/overview/#container-images\n\n        An admission controller could be used to enforce imagePullPolicy\n        \"\"\"\n        name = \"Image Pull Policy should be Always\"\n        id = \"CKV_K8S_15\"\n        # Location: container .imagePullPolicy\n        super().__init__(name=name, id=id)\n\n    def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult:\n        self.evaluated_container_keys = [\"image\", \"imagePullPolicy\"]\n        if conf.get(\"image\"):\n            # Remove the digest, if present\n            image_val = conf[\"image\"]\n            if not isinstance(image_val, str) or image_val.strip() == \"\":\n                return CheckResult.UNKNOWN\n            if \"@\" in image_val:\n                image_val = image_val[0 : image_val.index(\"@\")]\n                has_digest = True\n            else:\n                has_digest = False\n            if \"imagePullPolicy\" not in conf:\n                image_tag_match = re.findall(DOCKER_IMAGE_REGEX, image_val)\n                if len(image_tag_match) != 1:\n                    # If image name is invalid, check result can not be determined\n                    return CheckResult.UNKNOWN\n                (image, tag) = image_tag_match[0]\n                if tag == \"latest\" or tag == \"\":\n                    # Default imagePullPolicy = Always\n                    return CheckResult.PASSED\n                elif has_digest:\n                    return CheckResult.PASSED\n                else:\n                    # Default imagePullPolicy = IfNotPresent\n                    return CheckResult.FAILED\n            else:\n                if not has_digest and conf[\"imagePullPolicy\"] != \"Always\":\n                    return CheckResult.FAILED\n\n        else:\n            return CheckResult.FAILED\n        return CheckResult.PASSED\n\n\ncheck = ImagePullPolicyAlways()\n", "path": "checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py"}]}