Repository: bridgecrewio/checkov

Issue:
CKV_K8S_31 failure with RuntimeDefault configured for workloads
**Describe the bug**
Please see #710

**To Reproduce**
Please see #710

**Expected behavior**
Please see #710

**Additional context**
The bug reported in #710 needs to be fixed for workloads in https://github.com/bridgecrewio/checkov/blob/master/checkov/kubernetes/checks/Seccomp.py#L44:L48 as well.

```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
....
spec:
...
...
  template:
  ...
  ...
    spec:
    ....
    ....
      securityContext:
        allowPrivilegeEscalation: false
        seccompProfile:
          type: RuntimeDefault
```

**Related PRs**
#711 


Discussion:

Patch:
diff --git a/checkov/kubernetes/checks/Seccomp.py b/checkov/kubernetes/checks/Seccomp.py
index fdd9392b4..5946eab5a 100644
--- a/checkov/kubernetes/checks/Seccomp.py
+++ b/checkov/kubernetes/checks/Seccomp.py
@@ -34,6 +34,20 @@ class Seccomp(BaseK8Check):
                 return CheckResult.PASSED if security_profile == 'RuntimeDefault' else CheckResult.FAILED
             if "metadata" in conf:
                 metadata = conf["metadata"]
+        if conf['kind'] == 'Deployment':
+            security_profile = dpath.search(conf, 'spec/template/spec/securityContext/seccompProfile/type')
+            if security_profile:
+                security_profile = dpath.get(conf, 'spec/template/spec/securityContext/seccompProfile/type')
+                return CheckResult.PASSED if security_profile == 'RuntimeDefault' else CheckResult.FAILED
+            if "metadata" in conf:
+                metadata = conf["metadata"]
+        if conf['kind'] == 'StatefulSet':
+            security_profile = dpath.search(conf, 'spec/template/spec/securityContext/seccompProfile/type')
+            if security_profile:
+                security_profile = dpath.get(conf, 'spec/template/spec/securityContext/seccompProfile/type')
+                return CheckResult.PASSED if security_profile == 'RuntimeDefault' else CheckResult.FAILED
+            if "metadata" in conf:
+                metadata = conf["metadata"]            
         elif conf['kind'] == 'CronJob':
             if "spec" in conf:
                 if "jobTemplate" in conf["spec"]:


Test patch:
diff --git a/tests/kubernetes/checks/example_Seccomp/pod-seccomp-PASSED4.yaml b/tests/kubernetes/checks/example_Seccomp/pod-seccomp-PASSED4.yaml
new file mode 100644
index 000000000..f594400be
--- /dev/null
+++ b/tests/kubernetes/checks/example_Seccomp/pod-seccomp-PASSED4.yaml
@@ -0,0 +1,23 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: seccomp-passed-deployment
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: test
+  template:
+    metadata:
+      labels:
+        app: test
+    spec:
+      containers:
+      - name: test
+        image: quay.io/test:0.1
+        ports:
+        - containerPort: 1234
+      securityContext:
+        allowPrivilegeEscalation: false
+        seccompProfile:
+          type: RuntimeDefault
\ No newline at end of file
diff --git a/tests/kubernetes/checks/example_Seccomp/pod-seccomp-PASSED5.yaml b/tests/kubernetes/checks/example_Seccomp/pod-seccomp-PASSED5.yaml
new file mode 100644
index 000000000..3b8bb6263
--- /dev/null
+++ b/tests/kubernetes/checks/example_Seccomp/pod-seccomp-PASSED5.yaml
@@ -0,0 +1,38 @@
+
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: RELEASE-NAME
+  labels:
+    app.kubernetes.io/instance: RELEASE-NAME
+  annotations:
+  namespace: default
+spec:
+  serviceName: RELEASE-NAME
+  replicas: 1
+  updateStrategy:
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: RELEASE-NAME
+  template:
+    metadata:
+      name: RELEASE-NAME
+      labels:
+        app.kubernetes.io/instance: RELEASE-NAME
+      annotations:
+    spec:
+      affinity:
+        podAffinity:
+        podAntiAffinity:
+        nodeAffinity:
+      automountServiceAccountToken: false
+      securityContext:
+        allowPrivilegeEscalation: false
+        fsGroup: 10001
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: RELEASE-NAME
+          image: docker.io/test:1
+          imagePullPolicy: "Always"
\ No newline at end of file
diff --git a/tests/kubernetes/checks/test_Seccomp.py b/tests/kubernetes/checks/test_Seccomp.py
index 01530f432..013d27b7a 100644
--- a/tests/kubernetes/checks/test_Seccomp.py
+++ b/tests/kubernetes/checks/test_Seccomp.py
@@ -16,7 +16,7 @@ class TestSeccomp(unittest.TestCase):
         report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id]))
         summary = report.get_summary()
 
-        self.assertEqual(summary['passed'], 3)
+        self.assertEqual(summary['passed'], 5)
         self.assertEqual(summary['failed'], 1)
         self.assertEqual(summary['skipped'], 0)
         self.assertEqual(summary['parsing_errors'], 0)