Repository: bridgecrewio/checkov

Issue:
checkov skips all K8S standard policies if one or more custom policy is specified in --checks
**Description**
Using checkov to verify a kubernetes manifests (a single file with several objects: deployments, configmaps, etc) against a list of checks (so using the --check parameter), checkov verifies only the first check, and appears to skip all others checks in the provided list.

**Examples**
The [manifests are available here](https://gist.github.com/previ/cf193061c767f18be7616dd52739adb0#file-k8s-manifest-yaml)
The [parameters available in the log](https://gist.github.com/previ/cf193061c767f18be7616dd52739adb0#file-full_log_debug-log-L33)

**Version (please complete the following information):**
 - Checkov Version 2.2.232

**Additional context**
The [full log, LOG_DEVEL=DEBUG, is available here](https://gist.github.com/previ/cf193061c767f18be7616dd52739adb0#file-full_log_debug-log)
The custom policies yaml files are available [here](https://gist.github.com/previ/cf193061c767f18be7616dd52739adb0#file-k8s_pvc_gov01-yaml) and [here](https://gist.github.com/previ/cf193061c767f18be7616dd52739adb0#file-k8s_sts_gov01-yaml)



Discussion:
hey @previ thanks for reaching out.
you found quite an interesting problem, we have a special logic for Kubernetes checks, because you can also use `--check` and `--skip-check` with a Kubernetes namespace, ex `checkov -d . --skip-check kube-system`
Luckily `_` are not allowed for namespace names, therefore I will adjust the logic to allow custom checks as long as they an `_` in their ID.

Resolving patch:
diff --git a/checkov/kubernetes/checks/resource/base_registry.py b/checkov/kubernetes/checks/resource/base_registry.py
--- a/checkov/kubernetes/checks/resource/base_registry.py
+++ b/checkov/kubernetes/checks/resource/base_registry.py
@@ -54,35 +54,27 @@ def _should_run_scan(
             # Allow list provides namespace-only allows, check-only allows, or both
             # If namespaces not specified, all namespaces are scanned
             # If checks not specified, all checks are scanned
-            run_check = False
-            allowed_namespaces = [string for string in check_id_allowlist if ("CKV_" not in string and "BC_" not in string)]
-            if not any(("CKV_" in check or "BC_" in check) for check in check_id_allowlist) and not runner_filter.check_threshold:
+
+            if any("_" in check_id for check_id in check_id_allowlist) or runner_filter.check_threshold:
+                # a Kubernetes namespace can't have an '_' in its name,
+                # therefore we assume it is a built-in or custom check
+                if not runner_filter.should_run_check(check=check, report_type=report_type):
+                    return False
+
+            allowed_namespaces = [check_id for check_id in check_id_allowlist if "_" not in check_id]
+            if allowed_namespaces:
+                # Check if namespace in allowed namespaces
                 if "metadata" in entity_configuration and "namespace" in entity_configuration["metadata"]:
                     if entity_configuration["metadata"]["namespace"] in allowed_namespaces:
-                        run_check = True
+                        return True
                 elif "parent_metadata" in entity_configuration and "namespace" in entity_configuration["parent_metadata"]:
                     if entity_configuration["parent_metadata"]["namespace"] in allowed_namespaces:
-                        run_check = True
+                        return True
                 else:
                     if "default" in allowed_namespaces:
-                        run_check = True
+                        return True
             else:
-                if runner_filter.should_run_check(check=check, report_type=report_type):
-                    if allowed_namespaces:
-                        # Check if namespace in allowed namespaces
-                        if "metadata" in entity_configuration and "namespace" in entity_configuration["metadata"]:
-                            if entity_configuration["metadata"]["namespace"] in allowed_namespaces:
-                                run_check = True
-                        elif "parent_metadata" in entity_configuration and "namespace" in entity_configuration["parent_metadata"]:
-                            if entity_configuration["parent_metadata"]["namespace"] in allowed_namespaces:
-                                run_check = True
-                        else:
-                            if "default" in allowed_namespaces:
-                                run_check = True
-                    else:
-                        # No namespaces to filter
-                        run_check = True
-            if run_check:
+                # No namespaces to filter
                 return True
         elif check_id_denylist or runner_filter.skip_check_threshold or runner_filter.use_enforcement_rules:
             namespace_skip = False


Test patch:
diff --git a/tests/kubernetes/test_base_registry.py b/tests/kubernetes/test_base_registry.py
--- a/tests/kubernetes/test_base_registry.py
+++ b/tests/kubernetes/test_base_registry.py
@@ -141,6 +141,20 @@ def test_run_by_id_external_disabled(self):
         check = TestCheck('CKV_EXT_999')
         self.assertFalse(instance._should_run_scan(check, {}, run_filter, CheckType.KUBERNETES))
 
+    def test_run_by_id_external_custom(self):
+        instance = Registry(report_type=CheckType.KUBERNETES)
+        run_filter = RunnerFilter(checks=["K8S_EXT_999"], skip_checks=[])
+        run_filter.notify_external_check("K8S_EXT_999")
+        check = TestCheck('K8S_EXT_999')
+        self.assertTrue(instance._should_run_scan(check, {}, run_filter, CheckType.KUBERNETES))
+
+    def test_run_by_id_external_custom_disabled(self):
+        instance = Registry(report_type=CheckType.KUBERNETES)
+        run_filter = RunnerFilter(checks=[], skip_checks=["K8S_EXT_999"])
+        run_filter.notify_external_check("K8S_EXT_999")
+        check = TestCheck('K8S_EXT_999')
+        self.assertFalse(instance._should_run_scan(check, {}, run_filter, CheckType.KUBERNETES))
+
     # Namespace filtering
 
     def test_namespace_allow_default(self):