prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  checkov skips all K8S standard policies if one or more custom policy is specified in --checks
  **Description**
  Using checkov to verify a kubernetes manifests (a single file with several objects: deployments, configmaps, etc) against a list of checks (so using the --check parameter), checkov verifies only the first check, and appears to skip all others checks in the provided list.
  
  **Examples**
  The [manifests are available here](https://gist.github.com/previ/cf193061c767f18be7616dd52739adb0#file-k8s-manifest-yaml)
  The [parameters available in the log](https://gist.github.com/previ/cf193061c767f18be7616dd52739adb0#file-full_log_debug-log-L33)
  
  **Version (please complete the following information):**
   - Checkov Version 2.2.232
  
  **Additional context**
  The [full log, LOG_DEVEL=DEBUG, is available here](https://gist.github.com/previ/cf193061c767f18be7616dd52739adb0#file-full_log_debug-log)
  The custom policies yaml files are available [here](https://gist.github.com/previ/cf193061c767f18be7616dd52739adb0#file-k8s_pvc_gov01-yaml) and [here](https://gist.github.com/previ/cf193061c767f18be7616dd52739adb0#file-k8s_sts_gov01-yaml)
  
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `checkov/kubernetes/checks/resource/base_registry.py`
  Content:
  ```
  1 from __future__ import annotations
  2 
  3 from typing import Any, TYPE_CHECKING
  4 
  5 from checkov.common.checks.base_check_registry import BaseCheckRegistry
  6 
  7 if TYPE_CHECKING:
  8     from checkov.common.checks.base_check import BaseCheck
  9     from checkov.common.typing import _SkippedCheck, _CheckResult
  10     from checkov.runner_filter import RunnerFilter
  11 
  12 
  13 class Registry(BaseCheckRegistry):
  14     def __init__(self, report_type: str) -> None:
  15         super().__init__(report_type)
  16 
  17     def extract_entity_details(self, entity: dict[str, Any]) -> tuple[str, dict[str, Any]]:  # type:ignore[override]
  18         kind = entity.get("kind") or ""
  19         conf = entity
  20         return kind, conf
  21 
  22     def scan(
  23         self,
  24         scanned_file: str,
  25         entity: dict[str, Any],
  26         skipped_checks: list[_SkippedCheck],
  27         runner_filter: RunnerFilter,
  28         report_type: str | None = None,
  29     ) -> dict[BaseCheck, _CheckResult]:
  30         (entity_type, entity_configuration) = self.extract_entity_details(entity)
  31         results = {}
  32         checks = self.get_checks(entity_type)
  33         for check in checks:
  34             skip_info: "_SkippedCheck" = {}
  35             if skipped_checks:
  36                 if check.id in [x['id'] for x in skipped_checks]:
  37                     skip_info = [x for x in skipped_checks if x['id'] == check.id][0]
  38 
  39             if self._should_run_scan(check, entity_configuration, runner_filter, self.report_type):
  40                 self.logger.debug("Running check: {} on file {}".format(check.name, scanned_file))
  41 
  42                 result = check.run(scanned_file=scanned_file, entity_configuration=entity_configuration,
  43                                    entity_name=entity_type, entity_type=entity_type, skip_info=skip_info)
  44                 results[check] = result
  45         return results
  46 
  47     @staticmethod
  48     def _should_run_scan(
  49         check: BaseCheck, entity_configuration: dict[str, Any], runner_filter: RunnerFilter, report_type: str
  50     ) -> bool:
  51         check_id_allowlist = runner_filter.checks
  52         check_id_denylist = runner_filter.skip_checks
  53         if check_id_allowlist or runner_filter.check_threshold:
  54             # Allow list provides namespace-only allows, check-only allows, or both
  55             # If namespaces not specified, all namespaces are scanned
  56             # If checks not specified, all checks are scanned
  57             run_check = False
  58             allowed_namespaces = [string for string in check_id_allowlist if ("CKV_" not in string and "BC_" not in string)]
  59             if not any(("CKV_" in check or "BC_" in check) for check in check_id_allowlist) and not runner_filter.check_threshold:
  60                 if "metadata" in entity_configuration and "namespace" in entity_configuration["metadata"]:
  61                     if entity_configuration["metadata"]["namespace"] in allowed_namespaces:
  62                         run_check = True
  63                 elif "parent_metadata" in entity_configuration and "namespace" in entity_configuration["parent_metadata"]:
  64                     if entity_configuration["parent_metadata"]["namespace"] in allowed_namespaces:
  65                         run_check = True
  66                 else:
  67                     if "default" in allowed_namespaces:
  68                         run_check = True
  69             else:
  70                 if runner_filter.should_run_check(check=check, report_type=report_type):
  71                     if allowed_namespaces:
  72                         # Check if namespace in allowed namespaces
  73                         if "metadata" in entity_configuration and "namespace" in entity_configuration["metadata"]:
  74                             if entity_configuration["metadata"]["namespace"] in allowed_namespaces:
  75                                 run_check = True
  76                         elif "parent_metadata" in entity_configuration and "namespace" in entity_configuration["parent_metadata"]:
  77                             if entity_configuration["parent_metadata"]["namespace"] in allowed_namespaces:
  78                                 run_check = True
  79                         else:
  80                             if "default" in allowed_namespaces:
  81                                 run_check = True
  82                     else:
  83                         # No namespaces to filter
  84                         run_check = True
  85             if run_check:
  86                 return True
  87         elif check_id_denylist or runner_filter.skip_check_threshold or runner_filter.use_enforcement_rules:
  88             namespace_skip = False
  89             if "metadata" in entity_configuration and "namespace" in entity_configuration["metadata"]:
  90                 if entity_configuration["metadata"]["namespace"] in check_id_denylist:
  91                     namespace_skip = True
  92             elif "parent_metadata" in entity_configuration and "namespace" in entity_configuration["parent_metadata"]:
  93                 if entity_configuration["parent_metadata"]["namespace"] in check_id_denylist:
  94                     namespace_skip = True
  95             else:
  96                 if "default" in check_id_denylist:
  97                     namespace_skip = True
  98             if runner_filter.should_run_check(check=check, report_type=report_type) and not namespace_skip:
  99                 return True
  100         else:
  101             return True
  102         return False
  103
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/checkov/kubernetes/checks/resource/base_registry.py b/checkov/kubernetes/checks/resource/base_registry.py
  --- a/checkov/kubernetes/checks/resource/base_registry.py
  +++ b/checkov/kubernetes/checks/resource/base_registry.py
  @@ -54,35 +54,27 @@
               # Allow list provides namespace-only allows, check-only allows, or both
               # If namespaces not specified, all namespaces are scanned
               # If checks not specified, all checks are scanned
  -            run_check = False
  -            allowed_namespaces = [string for string in check_id_allowlist if ("CKV_" not in string and "BC_" not in string)]
  -            if not any(("CKV_" in check or "BC_" in check) for check in check_id_allowlist) and not runner_filter.check_threshold:
  +
  +            if any("_" in check_id for check_id in check_id_allowlist) or runner_filter.check_threshold:
  +                # a Kubernetes namespace can't have an '_' in its name,
  +                # therefore we assume it is a built-in or custom check
  +                if not runner_filter.should_run_check(check=check, report_type=report_type):
  +                    return False
  +
  +            allowed_namespaces = [check_id for check_id in check_id_allowlist if "_" not in check_id]
  +            if allowed_namespaces:
  +                # Check if namespace in allowed namespaces
                   if "metadata" in entity_configuration and "namespace" in entity_configuration["metadata"]:
                       if entity_configuration["metadata"]["namespace"] in allowed_namespaces:
  -                        run_check = True
  +                        return True
                   elif "parent_metadata" in entity_configuration and "namespace" in entity_configuration["parent_metadata"]:
                       if entity_configuration["parent_metadata"]["namespace"] in allowed_namespaces:
  -                        run_check = True
  +                        return True
                   else:
                       if "default" in allowed_namespaces:
  -                        run_check = True
  +                        return True
               else:
  -                if runner_filter.should_run_check(check=check, report_type=report_type):
  -                    if allowed_namespaces:
  -                        # Check if namespace in allowed namespaces
  -                        if "metadata" in entity_configuration and "namespace" in entity_configuration["metadata"]:
  -                            if entity_configuration["metadata"]["namespace"] in allowed_namespaces:
  -                                run_check = True
  -                        elif "parent_metadata" in entity_configuration and "namespace" in entity_configuration["parent_metadata"]:
  -                            if entity_configuration["parent_metadata"]["namespace"] in allowed_namespaces:
  -                                run_check = True
  -                        else:
  -                            if "default" in allowed_namespaces:
  -                                run_check = True
  -                    else:
  -                        # No namespaces to filter
  -                        run_check = True
  -            if run_check:
  +                # No namespaces to filter
                   return True
           elif check_id_denylist or runner_filter.skip_check_threshold or runner_filter.use_enforcement_rules:
               namespace_skip = False
  
verification_info: {"golden_diff": "diff --git a/checkov/kubernetes/checks/resource/base_registry.py b/checkov/kubernetes/checks/resource/base_registry.py\n--- a/checkov/kubernetes/checks/resource/base_registry.py\n+++ b/checkov/kubernetes/checks/resource/base_registry.py\n@@ -54,35 +54,27 @@\n             # Allow list provides namespace-only allows, check-only allows, or both\n             # If namespaces not specified, all namespaces are scanned\n             # If checks not specified, all checks are scanned\n-            run_check = False\n-            allowed_namespaces = [string for string in check_id_allowlist if (\"CKV_\" not in string and \"BC_\" not in string)]\n-            if not any((\"CKV_\" in check or \"BC_\" in check) for check in check_id_allowlist) and not runner_filter.check_threshold:\n+\n+            if any(\"_\" in check_id for check_id in check_id_allowlist) or runner_filter.check_threshold:\n+                # a Kubernetes namespace can't have an '_' in its name,\n+                # therefore we assume it is a built-in or custom check\n+                if not runner_filter.should_run_check(check=check, report_type=report_type):\n+                    return False\n+\n+            allowed_namespaces = [check_id for check_id in check_id_allowlist if \"_\" not in check_id]\n+            if allowed_namespaces:\n+                # Check if namespace in allowed namespaces\n                 if \"metadata\" in entity_configuration and \"namespace\" in entity_configuration[\"metadata\"]:\n                     if entity_configuration[\"metadata\"][\"namespace\"] in allowed_namespaces:\n-                        run_check = True\n+                        return True\n                 elif \"parent_metadata\" in entity_configuration and \"namespace\" in entity_configuration[\"parent_metadata\"]:\n                     if entity_configuration[\"parent_metadata\"][\"namespace\"] in allowed_namespaces:\n-                        run_check = True\n+                        return True\n                 else:\n                     if \"default\" in allowed_namespaces:\n-                        run_check = True\n+                        return True\n             else:\n-                if runner_filter.should_run_check(check=check, report_type=report_type):\n-                    if allowed_namespaces:\n-                        # Check if namespace in allowed namespaces\n-                        if \"metadata\" in entity_configuration and \"namespace\" in entity_configuration[\"metadata\"]:\n-                            if entity_configuration[\"metadata\"][\"namespace\"] in allowed_namespaces:\n-                                run_check = True\n-                        elif \"parent_metadata\" in entity_configuration and \"namespace\" in entity_configuration[\"parent_metadata\"]:\n-                            if entity_configuration[\"parent_metadata\"][\"namespace\"] in allowed_namespaces:\n-                                run_check = True\n-                        else:\n-                            if \"default\" in allowed_namespaces:\n-                                run_check = True\n-                    else:\n-                        # No namespaces to filter\n-                        run_check = True\n-            if run_check:\n+                # No namespaces to filter\n                 return True\n         elif check_id_denylist or runner_filter.skip_check_threshold or runner_filter.use_enforcement_rules:\n             namespace_skip = False\n", "issue": "checkov skips all K8S standard policies if one or more custom policy is specified in --checks\n**Description**\r\nUsing checkov to verify a kubernetes manifests (a single file with several objects: deployments, configmaps, etc) against a list of checks (so using the --check parameter), checkov verifies only the first check, and appears to skip all others checks in the provided list.\r\n\r\n**Examples**\r\nThe [manifests are available here](https://gist.github.com/previ/cf193061c767f18be7616dd52739adb0#file-k8s-manifest-yaml)\r\nThe [parameters available in the log](https://gist.github.com/previ/cf193061c767f18be7616dd52739adb0#file-full_log_debug-log-L33)\r\n\r\n**Version (please complete the following information):**\r\n - Checkov Version 2.2.232\r\n\r\n**Additional context**\r\nThe [full log, LOG_DEVEL=DEBUG, is available here](https://gist.github.com/previ/cf193061c767f18be7616dd52739adb0#file-full_log_debug-log)\r\nThe custom policies yaml files are available [here](https://gist.github.com/previ/cf193061c767f18be7616dd52739adb0#file-k8s_pvc_gov01-yaml) and [here](https://gist.github.com/previ/cf193061c767f18be7616dd52739adb0#file-k8s_sts_gov01-yaml)\r\n\n", "before_files": [{"content": "from __future__ import annotations\n\nfrom typing import Any, TYPE_CHECKING\n\nfrom checkov.common.checks.base_check_registry import BaseCheckRegistry\n\nif TYPE_CHECKING:\n    from checkov.common.checks.base_check import BaseCheck\n    from checkov.common.typing import _SkippedCheck, _CheckResult\n    from checkov.runner_filter import RunnerFilter\n\n\nclass Registry(BaseCheckRegistry):\n    def __init__(self, report_type: str) -> None:\n        super().__init__(report_type)\n\n    def extract_entity_details(self, entity: dict[str, Any]) -> tuple[str, dict[str, Any]]:  # type:ignore[override]\n        kind = entity.get(\"kind\") or \"\"\n        conf = entity\n        return kind, conf\n\n    def scan(\n        self,\n        scanned_file: str,\n        entity: dict[str, Any],\n        skipped_checks: list[_SkippedCheck],\n        runner_filter: RunnerFilter,\n        report_type: str | None = None,\n    ) -> dict[BaseCheck, _CheckResult]:\n        (entity_type, entity_configuration) = self.extract_entity_details(entity)\n        results = {}\n        checks = self.get_checks(entity_type)\n        for check in checks:\n            skip_info: \"_SkippedCheck\" = {}\n            if skipped_checks:\n                if check.id in [x['id'] for x in skipped_checks]:\n                    skip_info = [x for x in skipped_checks if x['id'] == check.id][0]\n\n            if self._should_run_scan(check, entity_configuration, runner_filter, self.report_type):\n                self.logger.debug(\"Running check: {} on file {}\".format(check.name, scanned_file))\n\n                result = check.run(scanned_file=scanned_file, entity_configuration=entity_configuration,\n                                   entity_name=entity_type, entity_type=entity_type, skip_info=skip_info)\n                results[check] = result\n        return results\n\n    @staticmethod\n    def _should_run_scan(\n        check: BaseCheck, entity_configuration: dict[str, Any], runner_filter: RunnerFilter, report_type: str\n    ) -> bool:\n        check_id_allowlist = runner_filter.checks\n        check_id_denylist = runner_filter.skip_checks\n        if check_id_allowlist or runner_filter.check_threshold:\n            # Allow list provides namespace-only allows, check-only allows, or both\n            # If namespaces not specified, all namespaces are scanned\n            # If checks not specified, all checks are scanned\n            run_check = False\n            allowed_namespaces = [string for string in check_id_allowlist if (\"CKV_\" not in string and \"BC_\" not in string)]\n            if not any((\"CKV_\" in check or \"BC_\" in check) for check in check_id_allowlist) and not runner_filter.check_threshold:\n                if \"metadata\" in entity_configuration and \"namespace\" in entity_configuration[\"metadata\"]:\n                    if entity_configuration[\"metadata\"][\"namespace\"] in allowed_namespaces:\n                        run_check = True\n                elif \"parent_metadata\" in entity_configuration and \"namespace\" in entity_configuration[\"parent_metadata\"]:\n                    if entity_configuration[\"parent_metadata\"][\"namespace\"] in allowed_namespaces:\n                        run_check = True\n                else:\n                    if \"default\" in allowed_namespaces:\n                        run_check = True\n            else:\n                if runner_filter.should_run_check(check=check, report_type=report_type):\n                    if allowed_namespaces:\n                        # Check if namespace in allowed namespaces\n                        if \"metadata\" in entity_configuration and \"namespace\" in entity_configuration[\"metadata\"]:\n                            if entity_configuration[\"metadata\"][\"namespace\"] in allowed_namespaces:\n                                run_check = True\n                        elif \"parent_metadata\" in entity_configuration and \"namespace\" in entity_configuration[\"parent_metadata\"]:\n                            if entity_configuration[\"parent_metadata\"][\"namespace\"] in allowed_namespaces:\n                                run_check = True\n                        else:\n                            if \"default\" in allowed_namespaces:\n                                run_check = True\n                    else:\n                        # No namespaces to filter\n                        run_check = True\n            if run_check:\n                return True\n        elif check_id_denylist or runner_filter.skip_check_threshold or runner_filter.use_enforcement_rules:\n            namespace_skip = False\n            if \"metadata\" in entity_configuration and \"namespace\" in entity_configuration[\"metadata\"]:\n                if entity_configuration[\"metadata\"][\"namespace\"] in check_id_denylist:\n                    namespace_skip = True\n            elif \"parent_metadata\" in entity_configuration and \"namespace\" in entity_configuration[\"parent_metadata\"]:\n                if entity_configuration[\"parent_metadata\"][\"namespace\"] in check_id_denylist:\n                    namespace_skip = True\n            else:\n                if \"default\" in check_id_denylist:\n                    namespace_skip = True\n            if runner_filter.should_run_check(check=check, report_type=report_type) and not namespace_skip:\n                return True\n        else:\n            return True\n        return False\n", "path": "checkov/kubernetes/checks/resource/base_registry.py"}], "after_files": [{"content": "from __future__ import annotations\n\nfrom typing import Any, TYPE_CHECKING\n\nfrom checkov.common.checks.base_check_registry import BaseCheckRegistry\n\nif TYPE_CHECKING:\n    from checkov.common.checks.base_check import BaseCheck\n    from checkov.common.typing import _SkippedCheck, _CheckResult\n    from checkov.runner_filter import RunnerFilter\n\n\nclass Registry(BaseCheckRegistry):\n    def __init__(self, report_type: str) -> None:\n        super().__init__(report_type)\n\n    def extract_entity_details(self, entity: dict[str, Any]) -> tuple[str, dict[str, Any]]:  # type:ignore[override]\n        kind = entity.get(\"kind\") or \"\"\n        conf = entity\n        return kind, conf\n\n    def scan(\n        self,\n        scanned_file: str,\n        entity: dict[str, Any],\n        skipped_checks: list[_SkippedCheck],\n        runner_filter: RunnerFilter,\n        report_type: str | None = None,\n    ) -> dict[BaseCheck, _CheckResult]:\n        (entity_type, entity_configuration) = self.extract_entity_details(entity)\n        results = {}\n        checks = self.get_checks(entity_type)\n        for check in checks:\n            skip_info: \"_SkippedCheck\" = {}\n            if skipped_checks:\n                if check.id in [x['id'] for x in skipped_checks]:\n                    skip_info = [x for x in skipped_checks if x['id'] == check.id][0]\n\n            if self._should_run_scan(check, entity_configuration, runner_filter, self.report_type):\n                self.logger.debug(\"Running check: {} on file {}\".format(check.name, scanned_file))\n\n                result = check.run(scanned_file=scanned_file, entity_configuration=entity_configuration,\n                                   entity_name=entity_type, entity_type=entity_type, skip_info=skip_info)\n                results[check] = result\n        return results\n\n    @staticmethod\n    def _should_run_scan(\n        check: BaseCheck, entity_configuration: dict[str, Any], runner_filter: RunnerFilter, report_type: str\n    ) -> bool:\n        check_id_allowlist = runner_filter.checks\n        check_id_denylist = runner_filter.skip_checks\n        if check_id_allowlist or runner_filter.check_threshold:\n            # Allow list provides namespace-only allows, check-only allows, or both\n            # If namespaces not specified, all namespaces are scanned\n            # If checks not specified, all checks are scanned\n\n            if any(\"_\" in check_id for check_id in check_id_allowlist) or runner_filter.check_threshold:\n                # a Kubernetes namespace can't have an '_' in its name,\n                # therefore we assume it is a built-in or custom check\n                if not runner_filter.should_run_check(check=check, report_type=report_type):\n                    return False\n\n            allowed_namespaces = [check_id for check_id in check_id_allowlist if \"_\" not in check_id]\n            if allowed_namespaces:\n                # Check if namespace in allowed namespaces\n                if \"metadata\" in entity_configuration and \"namespace\" in entity_configuration[\"metadata\"]:\n                    if entity_configuration[\"metadata\"][\"namespace\"] in allowed_namespaces:\n                        return True\n                elif \"parent_metadata\" in entity_configuration and \"namespace\" in entity_configuration[\"parent_metadata\"]:\n                    if entity_configuration[\"parent_metadata\"][\"namespace\"] in allowed_namespaces:\n                        return True\n                else:\n                    if \"default\" in allowed_namespaces:\n                        return True\n            else:\n                # No namespaces to filter\n                return True\n        elif check_id_denylist or runner_filter.skip_check_threshold or runner_filter.use_enforcement_rules:\n            namespace_skip = False\n            if \"metadata\" in entity_configuration and \"namespace\" in entity_configuration[\"metadata\"]:\n                if entity_configuration[\"metadata\"][\"namespace\"] in check_id_denylist:\n                    namespace_skip = True\n            elif \"parent_metadata\" in entity_configuration and \"namespace\" in entity_configuration[\"parent_metadata\"]:\n                if entity_configuration[\"parent_metadata\"][\"namespace\"] in check_id_denylist:\n                    namespace_skip = True\n            else:\n                if \"default\" in check_id_denylist:\n                    namespace_skip = True\n            if runner_filter.should_run_check(check=check, report_type=report_type) and not namespace_skip:\n                return True\n        else:\n            return True\n        return False\n", "path": "checkov/kubernetes/checks/resource/base_registry.py"}]}