Repository: bridgecrewio/checkov

Issue:
CKV_K8S_31 failure with RuntimeDefault configured
**Describe the bug**
CKV_K8S_31 failure when the `seccompProfile` type is configured as `RuntimeDefault` which is the new syntax.

**To Reproduce**
1. Define security context as below.
```yaml
...
securityContext:
  allowPrivilegeEscalation: false
  seccompProfile:
    type: RuntimeDefault
...
```
2. Run checkov for kubernetes.

**Expected behavior**
CKV_K8S_31 to pass with the following configuration.
```yaml
...
securityContext:
  allowPrivilegeEscalation: false
  seccompProfile:
    type: RuntimeDefault
...
```

**Screenshots**
N/A

**Desktop (please complete the following information):**
 - Kubernetes 1.19.0
-  OS: Ubuntu 18.04
 - Checkov Version: 1.0.657

**Additional context**
https://kubernetes.io/docs/tutorials/clusters/seccomp/#create-pod-that-uses-the-container-runtime-default-seccomp-profile


Discussion:

Patch:
diff --git a/checkov/kubernetes/checks/Seccomp.py b/checkov/kubernetes/checks/Seccomp.py
index f1991102c..fdd9392b4 100644
--- a/checkov/kubernetes/checks/Seccomp.py
+++ b/checkov/kubernetes/checks/Seccomp.py
@@ -1,3 +1,4 @@
+import dpath
 
 from checkov.common.models.enums import CheckCategories, CheckResult
 from checkov.kubernetes.base_spec_check import BaseK8Check
@@ -12,6 +13,7 @@ class Seccomp(BaseK8Check):
         # Location: Pod.metadata.annotations.seccomp.security.alpha.kubernetes.io/pod
         # Location: CronJob.spec.jobTemplate.spec.template.metadata.annotations.seccomp.security.alpha.kubernetes.io/pod
         # Location: *.spec.template.metadata.annotations.seccomp.security.alpha.kubernetes.io/pod
+        # Location: *.spec.securityContext.seccompProfile.type
         supported_kind = ['Pod', 'Deployment', 'DaemonSet', 'StatefulSet', 'ReplicaSet', 'ReplicationController', 'Job', 'CronJob']
         categories = [CheckCategories.KUBERNETES]
         super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind)
@@ -26,6 +28,10 @@ class Seccomp(BaseK8Check):
         metadata = {}
 
         if conf['kind'] == 'Pod':
+            security_profile = dpath.search(conf, 'spec/securityContext/seccompProfile/type')
+            if security_profile:
+                security_profile = dpath.get(conf, 'spec/securityContext/seccompProfile/type')
+                return CheckResult.PASSED if security_profile == 'RuntimeDefault' else CheckResult.FAILED
             if "metadata" in conf:
                 metadata = conf["metadata"]
         elif conf['kind'] == 'CronJob':
@@ -45,8 +51,9 @@ class Seccomp(BaseK8Check):
             if "annotations" in metadata and isinstance(metadata['annotations'], dict):
                 if "seccomp.security.alpha.kubernetes.io/pod" in metadata["annotations"]:
                     if ("docker/default" in metadata["annotations"]["seccomp.security.alpha.kubernetes.io/pod"] or
-                    "runtime/default" in metadata["annotations"]["seccomp.security.alpha.kubernetes.io/pod"]):
+                            "runtime/default" in metadata["annotations"]["seccomp.security.alpha.kubernetes.io/pod"]):
                         return CheckResult.PASSED
         return CheckResult.FAILED
 
+
 check = Seccomp()
diff --git a/checkov/terraform/checks/resource/aws/ALBListenerHTTPS.py b/checkov/terraform/checks/resource/aws/ALBListenerHTTPS.py
index fa84fb285..4e249902a 100644
--- a/checkov/terraform/checks/resource/aws/ALBListenerHTTPS.py
+++ b/checkov/terraform/checks/resource/aws/ALBListenerHTTPS.py
@@ -1,6 +1,7 @@
 from checkov.common.models.enums import CheckResult, CheckCategories
 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
 
+
 class ALBListenerHTTPS(BaseResourceCheck):
 
     def __init__(self):
@@ -26,8 +27,12 @@ class ALBListenerHTTPS(BaseResourceCheck):
                     default_action = conf['default_action'][0]
                     action_type = default_action['type']
                     if action_type == ['redirect']:
-                        if default_action.get('redirect') and default_action['redirect'][0]['protocol'] == ['HTTPS']:
-                            return CheckResult.PASSED
+                        if default_action.get('redirect'):
+                            protocol = default_action['redirect'][0].get('protocol')
+                            if protocol == ['HTTPS']:
+                                return CheckResult.PASSED
+                            elif protocol is None:
+                                return CheckResult.UNKNOWN
         return CheckResult.FAILED
 
 


Test patch:
diff --git a/tests/kubernetes/checks/example_Seccomp/pod-seccomp-PASSED3.yaml b/tests/kubernetes/checks/example_Seccomp/pod-seccomp-PASSED3.yaml
new file mode 100644
index 000000000..64c92f42e
--- /dev/null
+++ b/tests/kubernetes/checks/example_Seccomp/pod-seccomp-PASSED3.yaml
@@ -0,0 +1,27 @@
+# Source: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+apiVersion: v1
+kind: Pod
+metadata:
+  name: seccomp-passed
+spec:
+  securityContext:
+    runAsUser: 1000
+    runAsGroup: 3000
+    fsGroup: 2000
+    seccompProfile:
+      type: RuntimeDefault
+  volumes:
+  - name: sec-ctx-vol
+    emptyDir: {}
+  containers:
+  - name: sec-ctx-demo
+    image: busybox
+    command: [ "sh", "-c", "sleep 1h" ]
+    volumeMounts:
+    - name: sec-ctx-vol
+      mountPath: /data/demo
+    securityContext:
+      allowPrivilegeEscalation: false
+
+# kubectl exec -it seccomp-failed -- grep Seccomp /proc/1/status
+### This will return 'Seccomp:	 0' indicating docker running with no Seccomp 
diff --git a/tests/kubernetes/checks/test_Seccomp.py b/tests/kubernetes/checks/test_Seccomp.py
index 742e25141..01530f432 100644
--- a/tests/kubernetes/checks/test_Seccomp.py
+++ b/tests/kubernetes/checks/test_Seccomp.py
@@ -16,7 +16,7 @@ class TestSeccomp(unittest.TestCase):
         report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id]))
         summary = report.get_summary()
 
-        self.assertEqual(summary['passed'], 2)
+        self.assertEqual(summary['passed'], 3)
         self.assertEqual(summary['failed'], 1)
         self.assertEqual(summary['skipped'], 0)
         self.assertEqual(summary['parsing_errors'], 0)
diff --git a/tests/terraform/checks/resource/aws/test_ALBListenerHTTPS.py b/tests/terraform/checks/resource/aws/test_ALBListenerHTTPS.py
index 5364f42d5..effe3d1cf 100644
--- a/tests/terraform/checks/resource/aws/test_ALBListenerHTTPS.py
+++ b/tests/terraform/checks/resource/aws/test_ALBListenerHTTPS.py
@@ -1,5 +1,7 @@
 import unittest
 
+import hcl2
+
 from checkov.terraform.checks.resource.aws.ALBListenerHTTPS import check
 from checkov.common.models.enums import CheckResult
 
@@ -43,6 +45,25 @@ class TestALBListenerHTTPS(unittest.TestCase):
         scan_result = check.scan_resource_conf(conf=resource_conf)
         self.assertEqual(CheckResult.FAILED, scan_result)
 
+    def test_success_no_protocol(self):
+        hcl_res = hcl2.loads("""
+resource "aws_lb_listener" "http_redirector" {
+  load_balancer_arn = aws_lb.redirector.arn
+  port              = "80"
+  protocol          = "HTTP"
+  default_action {
+    type = "redirect"
+    redirect {
+      host        = "example.com"
+      status_code = "HTTP_302"
+    }
+  }
+}
+        """)
+        resource_conf = hcl_res['resource'][0]['aws_lb_listener']['http_redirector']
+        result = check.scan_resource_conf(resource_conf)
+        self.assertEqual(CheckResult.UNKNOWN, result)
+
 
 if __name__ == '__main__':
     unittest.main()