prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  Checkov Python error - kubernetes_pod_v1
  I get the following error when parsing a **kubernetes_pod_v1** resource:
  https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/pod_v1
  
  ```
  Error: -18 02:46:45,476 [MainThread  ] [ERROR]  Failed to run check CKV_K8S_[27](https://github.com/technology-services-and-platforms-accnz/dotc-aks/actions/runs/4728024195/jobs/8389176473#step:21:28) on /tfplan.json:kubernetes_pod_v1.test
  Traceback (most recent call last):
    File "/usr/local/lib/python3.10/site-packages/checkov/common/checks/base_check.py", line 73, in run
      check_result["result"] = self.scan_entity_conf(entity_configuration, entity_type)
    File "/usr/local/lib/python3.10/site-packages/checkov/terraform/checks/resource/base_resource_check.py", line 43, in scan_entity_conf
      return self.scan_resource_conf(conf)
    File "/usr/local/lib/python3.10/site-packages/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py", line 36, in scan_resource_conf
      if v.get("host_path"):
    File "/usr/local/lib/python3.10/site-packages/checkov/common/parsers/node.py", line 189, in __getattr__
      raise TemplateAttributeError(f'***name*** is invalid')
  checkov.common.parsers.node.TemplateAttributeError: get is invalid
  [...]
  ```
  
  For all the checks that fail.
  
  Checkov Version: :2.3.165
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py`
  Content:
  ```
  1 from __future__ import annotations
  2 
  3 from typing import Any
  4 
  5 from checkov.common.models.enums import CheckCategories, CheckResult
  6 from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
  7 
  8 
  9 class DockerSocketVolume(BaseResourceCheck):
  10     def __init__(self) -> None:
  11         # Exposing the socket gives container information and increases risk of exploit
  12         # read-only is not a solution but only makes it harder to exploit.
  13         # Location: Pod.spec.volumes[].hostPath.path
  14         # Location: CronJob.spec.jobTemplate.spec.template.spec.volumes[].hostPath.path
  15         # Location: *.spec.template.spec.volumes[].hostPath.path
  16         id = "CKV_K8S_27"
  17         name = "Do not expose the docker daemon socket to containers"
  18         supported_resources = ("kubernetes_pod", "kubernetes_pod_v1",
  19                                "kubernetes_deployment", "kubernetes_deployment_v1",
  20                                "kubernetes_daemonset", "kubernetes_daemon_set_v1")
  21         categories = (CheckCategories.NETWORKING,)
  22         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  23 
  24     def scan_resource_conf(self, conf: dict[str, list[Any]]):
  25         if "spec" not in conf:
  26             self.evaluated_keys = [""]
  27             return CheckResult.FAILED
  28 
  29         spec = conf['spec'][0]
  30         if not spec:
  31             return CheckResult.UNKNOWN
  32 
  33         if "volume" in spec and spec.get("volume"):
  34             volumes = spec.get("volume")
  35             for idx, v in enumerate(volumes):
  36                 if v.get("host_path"):
  37                     if "path" in v["host_path"][0]:
  38                         if v["host_path"][0]["path"] == ["/var/run/docker.sock"]:
  39                             self.evaluated_keys = [f"spec/volume/{idx}/host_path/[0]/path"]
  40                             return CheckResult.FAILED
  41         if "template" in spec and spec.get("template"):
  42             template = spec.get("template")[0]
  43             if "spec" in template:
  44                 temp_spec = template.get("spec")[0]
  45                 if "volume" in temp_spec and temp_spec.get("volume"):
  46                     volumes = temp_spec.get("volume")
  47                     for idx, v in enumerate(volumes):
  48                         if isinstance(v, dict) and v.get("host_path"):
  49                             if "path" in v["host_path"][0]:
  50                                 path = v["host_path"][0]["path"]
  51                                 if path == ["/var/run/docker.sock"]:
  52                                     self.evaluated_keys = [f"spec/template/spec/volume/{idx}/host_path/[0]/path"]
  53                                     return CheckResult.FAILED
  54 
  55         return CheckResult.PASSED
  56 
  57 
  58 check = DockerSocketVolume()
  59
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py b/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py
  --- a/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py
  +++ b/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py
  @@ -33,7 +33,7 @@
           if "volume" in spec and spec.get("volume"):
               volumes = spec.get("volume")
               for idx, v in enumerate(volumes):
  -                if v.get("host_path"):
  +                if isinstance(v, dict) and v.get("host_path"):
                       if "path" in v["host_path"][0]:
                           if v["host_path"][0]["path"] == ["/var/run/docker.sock"]:
                               self.evaluated_keys = [f"spec/volume/{idx}/host_path/[0]/path"]
  @@ -47,8 +47,7 @@
                       for idx, v in enumerate(volumes):
                           if isinstance(v, dict) and v.get("host_path"):
                               if "path" in v["host_path"][0]:
  -                                path = v["host_path"][0]["path"]
  -                                if path == ["/var/run/docker.sock"]:
  +                                if v["host_path"][0]["path"] == ["/var/run/docker.sock"]:
                                       self.evaluated_keys = [f"spec/template/spec/volume/{idx}/host_path/[0]/path"]
                                       return CheckResult.FAILED
  
verification_info: {"golden_diff": "diff --git a/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py b/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py\n--- a/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py\n+++ b/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py\n@@ -33,7 +33,7 @@\n         if \"volume\" in spec and spec.get(\"volume\"):\n             volumes = spec.get(\"volume\")\n             for idx, v in enumerate(volumes):\n-                if v.get(\"host_path\"):\n+                if isinstance(v, dict) and v.get(\"host_path\"):\n                     if \"path\" in v[\"host_path\"][0]:\n                         if v[\"host_path\"][0][\"path\"] == [\"/var/run/docker.sock\"]:\n                             self.evaluated_keys = [f\"spec/volume/{idx}/host_path/[0]/path\"]\n@@ -47,8 +47,7 @@\n                     for idx, v in enumerate(volumes):\n                         if isinstance(v, dict) and v.get(\"host_path\"):\n                             if \"path\" in v[\"host_path\"][0]:\n-                                path = v[\"host_path\"][0][\"path\"]\n-                                if path == [\"/var/run/docker.sock\"]:\n+                                if v[\"host_path\"][0][\"path\"] == [\"/var/run/docker.sock\"]:\n                                     self.evaluated_keys = [f\"spec/template/spec/volume/{idx}/host_path/[0]/path\"]\n                                     return CheckResult.FAILED\n", "issue": "Checkov Python error - kubernetes_pod_v1\nI get the following error when parsing a **kubernetes_pod_v1** resource:\r\nhttps://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/pod_v1\r\n\r\n```\r\nError: -18 02:46:45,476 [MainThread  ] [ERROR]  Failed to run check CKV_K8S_[27](https://github.com/technology-services-and-platforms-accnz/dotc-aks/actions/runs/4728024195/jobs/8389176473#step:21:28) on /tfplan.json:kubernetes_pod_v1.test\r\nTraceback (most recent call last):\r\n  File \"/usr/local/lib/python3.10/site-packages/checkov/common/checks/base_check.py\", line 73, in run\r\n    check_result[\"result\"] = self.scan_entity_conf(entity_configuration, entity_type)\r\n  File \"/usr/local/lib/python3.10/site-packages/checkov/terraform/checks/resource/base_resource_check.py\", line 43, in scan_entity_conf\r\n    return self.scan_resource_conf(conf)\r\n  File \"/usr/local/lib/python3.10/site-packages/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py\", line 36, in scan_resource_conf\r\n    if v.get(\"host_path\"):\r\n  File \"/usr/local/lib/python3.10/site-packages/checkov/common/parsers/node.py\", line 189, in __getattr__\r\n    raise TemplateAttributeError(f'***name*** is invalid')\r\ncheckov.common.parsers.node.TemplateAttributeError: get is invalid\r\n[...]\r\n```\r\n\r\nFor all the checks that fail.\r\n\r\nCheckov Version: :2.3.165\n", "before_files": [{"content": "from __future__ import annotations\n\nfrom typing import Any\n\nfrom checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n\n\nclass DockerSocketVolume(BaseResourceCheck):\n    def __init__(self) -> None:\n        # Exposing the socket gives container information and increases risk of exploit\n        # read-only is not a solution but only makes it harder to exploit.\n        # Location: Pod.spec.volumes[].hostPath.path\n        # Location: CronJob.spec.jobTemplate.spec.template.spec.volumes[].hostPath.path\n        # Location: *.spec.template.spec.volumes[].hostPath.path\n        id = \"CKV_K8S_27\"\n        name = \"Do not expose the docker daemon socket to containers\"\n        supported_resources = (\"kubernetes_pod\", \"kubernetes_pod_v1\",\n                               \"kubernetes_deployment\", \"kubernetes_deployment_v1\",\n                               \"kubernetes_daemonset\", \"kubernetes_daemon_set_v1\")\n        categories = (CheckCategories.NETWORKING,)\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf: dict[str, list[Any]]):\n        if \"spec\" not in conf:\n            self.evaluated_keys = [\"\"]\n            return CheckResult.FAILED\n\n        spec = conf['spec'][0]\n        if not spec:\n            return CheckResult.UNKNOWN\n\n        if \"volume\" in spec and spec.get(\"volume\"):\n            volumes = spec.get(\"volume\")\n            for idx, v in enumerate(volumes):\n                if v.get(\"host_path\"):\n                    if \"path\" in v[\"host_path\"][0]:\n                        if v[\"host_path\"][0][\"path\"] == [\"/var/run/docker.sock\"]:\n                            self.evaluated_keys = [f\"spec/volume/{idx}/host_path/[0]/path\"]\n                            return CheckResult.FAILED\n        if \"template\" in spec and spec.get(\"template\"):\n            template = spec.get(\"template\")[0]\n            if \"spec\" in template:\n                temp_spec = template.get(\"spec\")[0]\n                if \"volume\" in temp_spec and temp_spec.get(\"volume\"):\n                    volumes = temp_spec.get(\"volume\")\n                    for idx, v in enumerate(volumes):\n                        if isinstance(v, dict) and v.get(\"host_path\"):\n                            if \"path\" in v[\"host_path\"][0]:\n                                path = v[\"host_path\"][0][\"path\"]\n                                if path == [\"/var/run/docker.sock\"]:\n                                    self.evaluated_keys = [f\"spec/template/spec/volume/{idx}/host_path/[0]/path\"]\n                                    return CheckResult.FAILED\n\n        return CheckResult.PASSED\n\n\ncheck = DockerSocketVolume()\n", "path": "checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py"}], "after_files": [{"content": "from __future__ import annotations\n\nfrom typing import Any\n\nfrom checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck\n\n\nclass DockerSocketVolume(BaseResourceCheck):\n    def __init__(self) -> None:\n        # Exposing the socket gives container information and increases risk of exploit\n        # read-only is not a solution but only makes it harder to exploit.\n        # Location: Pod.spec.volumes[].hostPath.path\n        # Location: CronJob.spec.jobTemplate.spec.template.spec.volumes[].hostPath.path\n        # Location: *.spec.template.spec.volumes[].hostPath.path\n        id = \"CKV_K8S_27\"\n        name = \"Do not expose the docker daemon socket to containers\"\n        supported_resources = (\"kubernetes_pod\", \"kubernetes_pod_v1\",\n                               \"kubernetes_deployment\", \"kubernetes_deployment_v1\",\n                               \"kubernetes_daemonset\", \"kubernetes_daemon_set_v1\")\n        categories = (CheckCategories.NETWORKING,)\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf: dict[str, list[Any]]):\n        if \"spec\" not in conf:\n            self.evaluated_keys = [\"\"]\n            return CheckResult.FAILED\n\n        spec = conf['spec'][0]\n        if not spec:\n            return CheckResult.UNKNOWN\n\n        if \"volume\" in spec and spec.get(\"volume\"):\n            volumes = spec.get(\"volume\")\n            for idx, v in enumerate(volumes):\n                if isinstance(v, dict) and v.get(\"host_path\"):\n                    if \"path\" in v[\"host_path\"][0]:\n                        if v[\"host_path\"][0][\"path\"] == [\"/var/run/docker.sock\"]:\n                            self.evaluated_keys = [f\"spec/volume/{idx}/host_path/[0]/path\"]\n                            return CheckResult.FAILED\n        if \"template\" in spec and spec.get(\"template\"):\n            template = spec.get(\"template\")[0]\n            if \"spec\" in template:\n                temp_spec = template.get(\"spec\")[0]\n                if \"volume\" in temp_spec and temp_spec.get(\"volume\"):\n                    volumes = temp_spec.get(\"volume\")\n                    for idx, v in enumerate(volumes):\n                        if isinstance(v, dict) and v.get(\"host_path\"):\n                            if \"path\" in v[\"host_path\"][0]:\n                                if v[\"host_path\"][0][\"path\"] == [\"/var/run/docker.sock\"]:\n                                    self.evaluated_keys = [f\"spec/template/spec/volume/{idx}/host_path/[0]/path\"]\n                                    return CheckResult.FAILED\n\n        return CheckResult.PASSED\n\n\ncheck = DockerSocketVolume()\n", "path": "checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py"}]}