prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  BC_K8S_14/CKV_K8S_15 "Image Pull Policy should be Always" should not be reported when using a digest
  **Describe the issue**
  [BC_K8S_14/CKV_K8S_15 "Image Pull Policy should be Always"](https://docs.bridgecrew.io/docs/bc_k8s_14) should not be reported when using a digest.
  
  Per the documentation:
  >  When the imagePullPolicy is set to Always, you ensure the latest version of the image is deployed every time the pod is started.
  
  By specifying the digest, the same image is always used, so there is no concern about the latest version (since the the version cannot change), negating the need to always pull the image.
  
  **Examples**
  Save the following as `deployment.yaml`:
  ```yaml
  apiVersion: v1
  kind: Pod
  metadata:
    name: <name>
  spec:
    containers:
      - name: nginx
        image: 'nginx@sha256:b0ad43f7ee5edbc0effbc14645ae7055e21bc1973aee5150745632a24a752661'
        imagePullPolicy: IfNotPresent
  ```
  Run: `checkov --framework kubernetes -f deployment.yaml -c CKV_K8S_15`
  
  Actual result:
  FAILED
  
  Expected result:
  Passed
  
  **Version (please complete the following information):**
   - Checkov Version 2.3.126
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py`
  Content:
  ```
  1 from checkov.common.models.enums import CheckCategories, CheckResult
  2 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
  3 
  4 
  5 class ImagePullPolicyAlways(BaseResourceCheck):
  6 
  7     def __init__(self):
  8         """
  9         Image pull policy should be set to always to ensure you get the correct image and imagePullSecrets are correct
  10         Default is 'IfNotPresent' unless image tag is omitted or :latest
  11         https://kubernetes.io/docs/concepts/configuration/overview/#container-images
  12 
  13         An admission controller could be used to enforce imagePullPolicy
  14         """
  15         name = "Image Pull Policy should be Always"
  16         id = "CKV_K8S_15"
  17         supported_resources = ["kubernetes_pod", "kubernetes_pod_v1",
  18                                "kubernetes_deployment", "kubernetes_deployment_v1"]
  19         categories = [CheckCategories.GENERAL_SECURITY]
  20         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  21 
  22     def scan_resource_conf(self, conf) -> CheckResult:
  23         spec = conf.get('spec', [None])[0]
  24         if isinstance(spec, dict) and spec:
  25             evaluated_keys_path = "spec"
  26 
  27             template = spec.get("template")
  28             if template and isinstance(template, list):
  29                 template = template[0]
  30                 template_spec = template.get("spec")
  31                 if template_spec and isinstance(template_spec, list):
  32                     spec = template_spec[0]
  33                     evaluated_keys_path = f'{evaluated_keys_path}/[0]/template/[0]/spec'
  34 
  35             containers = spec.get("container")
  36             if containers is None:
  37                 return CheckResult.UNKNOWN
  38             for idx, container in enumerate(containers):
  39                 if not isinstance(container, dict):
  40                     return CheckResult.UNKNOWN
  41 
  42                 if container.get("image_pull_policy"):
  43                     if container.get("image_pull_policy")[0] == "Always":
  44                         break
  45                 else:
  46                     if container.get("image"):
  47                         name = container.get("image")[0]
  48                         if "latest" in name:
  49                             break
  50                 self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]']
  51                 return CheckResult.FAILED
  52             return CheckResult.PASSED
  53         return CheckResult.FAILED
  54 
  55 
  56 check = ImagePullPolicyAlways()
  57
  ```
  
  Path: `checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py`
  Content:
  ```
  1 import re
  2 from typing import Any, Dict
  3 
  4 from checkov.common.models.consts import DOCKER_IMAGE_REGEX
  5 from checkov.common.models.enums import CheckResult
  6 from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck
  7 
  8 
  9 class ImagePullPolicyAlways(BaseK8sContainerCheck):
  10     def __init__(self) -> None:
  11         """
  12         Image pull policy should be set to always to ensure you get the correct image and imagePullSecrets are correct
  13         Default is 'IfNotPresent' unless image tag is omitted or :latest
  14         https://kubernetes.io/docs/concepts/configuration/overview/#container-images
  15 
  16         An admission controller could be used to enforce imagePullPolicy
  17         """
  18         name = "Image Pull Policy should be Always"
  19         id = "CKV_K8S_15"
  20         # Location: container .imagePullPolicy
  21         super().__init__(name=name, id=id)
  22 
  23     def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult:
  24         self.evaluated_container_keys = ["image", "imagePullPolicy"]
  25         if conf.get("image"):
  26             # Remove the digest, if present
  27             image_val = conf["image"]
  28             if not isinstance(image_val, str) or image_val.strip() == "":
  29                 return CheckResult.UNKNOWN
  30             if "@" in image_val:
  31                 image_val = image_val[0 : image_val.index("@")]
  32             if "imagePullPolicy" not in conf:
  33                 image_tag_match = re.findall(DOCKER_IMAGE_REGEX, image_val)
  34                 if len(image_tag_match) != 1:
  35                     # If image name is invalid, check result can not be determined
  36                     return CheckResult.UNKNOWN
  37                 (image, tag) = image_tag_match[0]
  38                 if tag == "latest" or tag == "":
  39                     # Default imagePullPolicy = Always
  40                     return CheckResult.PASSED
  41                 else:
  42                     # Default imagePullPolicy = IfNotPresent
  43                     return CheckResult.FAILED
  44             else:
  45                 if conf["imagePullPolicy"] != "Always":
  46                     return CheckResult.FAILED
  47 
  48         else:
  49             return CheckResult.FAILED
  50         return CheckResult.PASSED
  51 
  52 
  53 check = ImagePullPolicyAlways()
  54
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py b/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py
  --- a/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py
  +++ b/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py
  @@ -29,6 +29,9 @@
                   return CheckResult.UNKNOWN
               if "@" in image_val:
                   image_val = image_val[0 : image_val.index("@")]
  +                has_digest = True
  +            else:
  +                has_digest = False
               if "imagePullPolicy" not in conf:
                   image_tag_match = re.findall(DOCKER_IMAGE_REGEX, image_val)
                   if len(image_tag_match) != 1:
  @@ -38,11 +41,13 @@
                   if tag == "latest" or tag == "":
                       # Default imagePullPolicy = Always
                       return CheckResult.PASSED
  +                elif has_digest:
  +                    return CheckResult.PASSED
                   else:
                       # Default imagePullPolicy = IfNotPresent
                       return CheckResult.FAILED
               else:
  -                if conf["imagePullPolicy"] != "Always":
  +                if not has_digest and conf["imagePullPolicy"] != "Always":
                       return CheckResult.FAILED
   
           else:
  diff --git a/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py b/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py
  --- a/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py
  +++ b/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py
  @@ -7,7 +7,7 @@
       def __init__(self):
           """
           Image pull policy should be set to always to ensure you get the correct image and imagePullSecrets are correct
  -        Default is 'IfNotPresent' unless image tag is omitted or :latest
  +        Default is 'IfNotPresent' unless image tag/digest is omitted or :latest
           https://kubernetes.io/docs/concepts/configuration/overview/#container-images
   
           An admission controller could be used to enforce imagePullPolicy
  @@ -47,6 +47,8 @@
                           name = container.get("image")[0]
                           if "latest" in name:
                               break
  +                        if "@" in name:
  +                            break
                   self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]']
                   return CheckResult.FAILED
               return CheckResult.PASSED
  
verification_info: {"golden_diff": "diff --git a/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py b/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py\n--- a/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py\n+++ b/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py\n@@ -29,6 +29,9 @@\n                 return CheckResult.UNKNOWN\n             if \"@\" in image_val:\n                 image_val = image_val[0 : image_val.index(\"@\")]\n+                has_digest = True\n+            else:\n+                has_digest = False\n             if \"imagePullPolicy\" not in conf:\n                 image_tag_match = re.findall(DOCKER_IMAGE_REGEX, image_val)\n                 if len(image_tag_match) != 1:\n@@ -38,11 +41,13 @@\n                 if tag == \"latest\" or tag == \"\":\n                     # Default imagePullPolicy = Always\n                     return CheckResult.PASSED\n+                elif has_digest:\n+                    return CheckResult.PASSED\n                 else:\n                     # Default imagePullPolicy = IfNotPresent\n                     return CheckResult.FAILED\n             else:\n-                if conf[\"imagePullPolicy\"] != \"Always\":\n+                if not has_digest and conf[\"imagePullPolicy\"] != \"Always\":\n                     return CheckResult.FAILED\n \n         else:\ndiff --git a/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py b/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py\n--- a/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py\n+++ b/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py\n@@ -7,7 +7,7 @@\n     def __init__(self):\n         \"\"\"\n         Image pull policy should be set to always to ensure you get the correct image and imagePullSecrets are correct\n-        Default is 'IfNotPresent' unless image tag is omitted or :latest\n+        Default is 'IfNotPresent' unless image tag/digest is omitted or :latest\n         https://kubernetes.io/docs/concepts/configuration/overview/#container-images\n \n         An admission controller could be used to enforce imagePullPolicy\n@@ -47,6 +47,8 @@\n                         name = container.get(\"image\")[0]\n                         if \"latest\" in name:\n                             break\n+                        if \"@\" in name:\n+                            break\n                 self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]']\n                 return CheckResult.FAILED\n             return CheckResult.PASSED\n", "issue": "BC_K8S_14/CKV_K8S_15 \"Image Pull Policy should be Always\" should not be reported when using a digest\n**Describe the issue**\r\n[BC_K8S_14/CKV_K8S_15 \"Image Pull Policy should be Always\"](https://docs.bridgecrew.io/docs/bc_k8s_14) should not be reported when using a digest.\r\n\r\nPer the documentation:\r\n>  When the imagePullPolicy is set to Always, you ensure the latest version of the image is deployed every time the pod is started.\r\n\r\nBy specifying the digest, the same image is always used, so there is no concern about the latest version (since the the version cannot change), negating the need to always pull the image.\r\n\r\n**Examples**\r\nSave the following as `deployment.yaml`:\r\n```yaml\r\napiVersion: v1\r\nkind: Pod\r\nmetadata:\r\n  name: <name>\r\nspec:\r\n  containers:\r\n    - name: nginx\r\n      image: 'nginx@sha256:b0ad43f7ee5edbc0effbc14645ae7055e21bc1973aee5150745632a24a752661'\r\n      imagePullPolicy: IfNotPresent\r\n```\r\nRun: `checkov --framework kubernetes -f deployment.yaml -c CKV_K8S_15`\r\n\r\nActual result:\r\nFAILED\r\n\r\nExpected result:\r\nPassed\r\n\r\n**Version (please complete the following information):**\r\n - Checkov Version 2.3.126\n", "before_files": [{"content": "from checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n\n\nclass ImagePullPolicyAlways(BaseResourceCheck):\n\n    def __init__(self):\n        \"\"\"\n        Image pull policy should be set to always to ensure you get the correct image and imagePullSecrets are correct\n        Default is 'IfNotPresent' unless image tag is omitted or :latest\n        https://kubernetes.io/docs/concepts/configuration/overview/#container-images\n\n        An admission controller could be used to enforce imagePullPolicy\n        \"\"\"\n        name = \"Image Pull Policy should be Always\"\n        id = \"CKV_K8S_15\"\n        supported_resources = [\"kubernetes_pod\", \"kubernetes_pod_v1\",\n                               \"kubernetes_deployment\", \"kubernetes_deployment_v1\"]\n        categories = [CheckCategories.GENERAL_SECURITY]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf) -> CheckResult:\n        spec = conf.get('spec', [None])[0]\n        if isinstance(spec, dict) and spec:\n            evaluated_keys_path = \"spec\"\n\n            template = spec.get(\"template\")\n            if template and isinstance(template, list):\n                template = template[0]\n                template_spec = template.get(\"spec\")\n                if template_spec and isinstance(template_spec, list):\n                    spec = template_spec[0]\n                    evaluated_keys_path = f'{evaluated_keys_path}/[0]/template/[0]/spec'\n\n            containers = spec.get(\"container\")\n            if containers is None:\n                return CheckResult.UNKNOWN\n            for idx, container in enumerate(containers):\n                if not isinstance(container, dict):\n                    return CheckResult.UNKNOWN\n\n                if container.get(\"image_pull_policy\"):\n                    if container.get(\"image_pull_policy\")[0] == \"Always\":\n                        break\n                else:\n                    if container.get(\"image\"):\n                        name = container.get(\"image\")[0]\n                        if \"latest\" in name:\n                            break\n                self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]']\n                return CheckResult.FAILED\n            return CheckResult.PASSED\n        return CheckResult.FAILED\n\n\ncheck = ImagePullPolicyAlways()\n", "path": "checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py"}, {"content": "import re\nfrom typing import Any, Dict\n\nfrom checkov.common.models.consts import DOCKER_IMAGE_REGEX\nfrom checkov.common.models.enums import CheckResult\nfrom checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck\n\n\nclass ImagePullPolicyAlways(BaseK8sContainerCheck):\n    def __init__(self) -> None:\n        \"\"\"\n        Image pull policy should be set to always to ensure you get the correct image and imagePullSecrets are correct\n        Default is 'IfNotPresent' unless image tag is omitted or :latest\n        https://kubernetes.io/docs/concepts/configuration/overview/#container-images\n\n        An admission controller could be used to enforce imagePullPolicy\n        \"\"\"\n        name = \"Image Pull Policy should be Always\"\n        id = \"CKV_K8S_15\"\n        # Location: container .imagePullPolicy\n        super().__init__(name=name, id=id)\n\n    def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult:\n        self.evaluated_container_keys = [\"image\", \"imagePullPolicy\"]\n        if conf.get(\"image\"):\n            # Remove the digest, if present\n            image_val = conf[\"image\"]\n            if not isinstance(image_val, str) or image_val.strip() == \"\":\n                return CheckResult.UNKNOWN\n            if \"@\" in image_val:\n                image_val = image_val[0 : image_val.index(\"@\")]\n            if \"imagePullPolicy\" not in conf:\n                image_tag_match = re.findall(DOCKER_IMAGE_REGEX, image_val)\n                if len(image_tag_match) != 1:\n                    # If image name is invalid, check result can not be determined\n                    return CheckResult.UNKNOWN\n                (image, tag) = image_tag_match[0]\n                if tag == \"latest\" or tag == \"\":\n                    # Default imagePullPolicy = Always\n                    return CheckResult.PASSED\n                else:\n                    # Default imagePullPolicy = IfNotPresent\n                    return CheckResult.FAILED\n            else:\n                if conf[\"imagePullPolicy\"] != \"Always\":\n                    return CheckResult.FAILED\n\n        else:\n            return CheckResult.FAILED\n        return CheckResult.PASSED\n\n\ncheck = ImagePullPolicyAlways()\n", "path": "checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py"}], "after_files": [{"content": "from checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n\n\nclass ImagePullPolicyAlways(BaseResourceCheck):\n\n    def __init__(self):\n        \"\"\"\n        Image pull policy should be set to always to ensure you get the correct image and imagePullSecrets are correct\n        Default is 'IfNotPresent' unless image tag/digest is omitted or :latest\n        https://kubernetes.io/docs/concepts/configuration/overview/#container-images\n\n        An admission controller could be used to enforce imagePullPolicy\n        \"\"\"\n        name = \"Image Pull Policy should be Always\"\n        id = \"CKV_K8S_15\"\n        supported_resources = [\"kubernetes_pod\", \"kubernetes_pod_v1\",\n                               \"kubernetes_deployment\", \"kubernetes_deployment_v1\"]\n        categories = [CheckCategories.GENERAL_SECURITY]\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf) -> CheckResult:\n        spec = conf.get('spec', [None])[0]\n        if isinstance(spec, dict) and spec:\n            evaluated_keys_path = \"spec\"\n\n            template = spec.get(\"template\")\n            if template and isinstance(template, list):\n                template = template[0]\n                template_spec = template.get(\"spec\")\n                if template_spec and isinstance(template_spec, list):\n                    spec = template_spec[0]\n                    evaluated_keys_path = f'{evaluated_keys_path}/[0]/template/[0]/spec'\n\n            containers = spec.get(\"container\")\n            if containers is None:\n                return CheckResult.UNKNOWN\n            for idx, container in enumerate(containers):\n                if not isinstance(container, dict):\n                    return CheckResult.UNKNOWN\n\n                if container.get(\"image_pull_policy\"):\n                    if container.get(\"image_pull_policy\")[0] == \"Always\":\n                        break\n                else:\n                    if container.get(\"image\"):\n                        name = container.get(\"image\")[0]\n                        if \"latest\" in name:\n                            break\n                        if \"@\" in name:\n                            break\n                self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]']\n                return CheckResult.FAILED\n            return CheckResult.PASSED\n        return CheckResult.FAILED\n\n\ncheck = ImagePullPolicyAlways()\n", "path": "checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py"}, {"content": "import re\nfrom typing import Any, Dict\n\nfrom checkov.common.models.consts import DOCKER_IMAGE_REGEX\nfrom checkov.common.models.enums import CheckResult\nfrom checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck\n\n\nclass ImagePullPolicyAlways(BaseK8sContainerCheck):\n    def __init__(self) -> None:\n        \"\"\"\n        Image pull policy should be set to always to ensure you get the correct image and imagePullSecrets are correct\n        Default is 'IfNotPresent' unless image tag is omitted or :latest\n        https://kubernetes.io/docs/concepts/configuration/overview/#container-images\n\n        An admission controller could be used to enforce imagePullPolicy\n        \"\"\"\n        name = \"Image Pull Policy should be Always\"\n        id = \"CKV_K8S_15\"\n        # Location: container .imagePullPolicy\n        super().__init__(name=name, id=id)\n\n    def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult:\n        self.evaluated_container_keys = [\"image\", \"imagePullPolicy\"]\n        if conf.get(\"image\"):\n            # Remove the digest, if present\n            image_val = conf[\"image\"]\n            if not isinstance(image_val, str) or image_val.strip() == \"\":\n                return CheckResult.UNKNOWN\n            if \"@\" in image_val:\n                image_val = image_val[0 : image_val.index(\"@\")]\n                has_digest = True\n            else:\n                has_digest = False\n            if \"imagePullPolicy\" not in conf:\n                image_tag_match = re.findall(DOCKER_IMAGE_REGEX, image_val)\n                if len(image_tag_match) != 1:\n                    # If image name is invalid, check result can not be determined\n                    return CheckResult.UNKNOWN\n                (image, tag) = image_tag_match[0]\n                if tag == \"latest\" or tag == \"\":\n                    # Default imagePullPolicy = Always\n                    return CheckResult.PASSED\n                elif has_digest:\n                    return CheckResult.PASSED\n                else:\n                    # Default imagePullPolicy = IfNotPresent\n                    return CheckResult.FAILED\n            else:\n                if not has_digest and conf[\"imagePullPolicy\"] != \"Always\":\n                    return CheckResult.FAILED\n\n        else:\n            return CheckResult.FAILED\n        return CheckResult.PASSED\n\n\ncheck = ImagePullPolicyAlways()\n", "path": "checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py"}]}