feat(kubernetes): add CKV_K8S_50 automount service account token check

[beltagyy]

What is this?

Added a new Kubernetes security check (CKV_K8S_50) that warns when pods automatically mount service account tokens.

Why?

Kubernetes automatically gives every pod a login token by default. If an attacker breaks into your pod, they can use that token to access the cluster API and move laterally. Setting automount_service_account_token = false prevents this.

This is CIS Kubernetes Benchmark 5.1.1.

Example

# GOOD - no token mounted
resource "kubernetes_pod" "safe" {
  spec {
    automount_service_account_token = false
    container {
      name  = "app"
      image = "nginx"
    }
  }
}

# BAD - token mounted (default)
resource "kubernetes_pod" "risky" {
  spec {
    container {
      name  = "app"
      image = "nginx"
    }
  }
}

What changed

• Added checkov/terraform/checks/resource/kubernetes/AutomountServiceAccountToken.py
• Added unit tests with pass/fail cases
• Test results: 2 passed, 3 failed as expected ✅