Add OIDC to bootstrap CLI #3399

Samra10 · 2023-09-25T12:08:36Z

Closes #3275

What changed?

Add bootstrap command for gitops bootstrap to add OIDC configs

Why was this change made?

To help the user to configure OIDC settings after WGE installation

How was this change implemented?

https://www.notion.so/weaveworks/Onboarding-Single-Flow-CLI-for-WGE-Install-on-Management-Cluster-54553482666e425f9786dcc8138b5974?pvs=4#3fe4b2ac918b47248a6e82f10f9f3a61

How did you validate the change?

Manual testing
Unit tests

How to test: #3399 (comment)

Release notes

Documentation Changes

Other follow ups

cmd/gitops/app/bootstrap/cmd.go

enekofb

if feels that we are closer here. I have added some more comments on the code.

I would like to test it to understand the user experience. However, i could not find indications in the PR on how to do that (please see here https://github.com/weaveworks/weave-gitops-enterprise/blob/main/.github/pull_request_template.md?plain=1#L36)

I could not see higher level testing for the scenario of bootstrapping wge with oidc as flow nor as a single. please let me know your expectations here.

Regarding testing: please, let me know how should i verify that it works and the strategy for having automated testing for both bootstrap command and bootstrap auth. i could not find them in the PR.

enekofb · 2023-10-24T09:12:20Z

cmd/gitops/app/bootstrap/cmd.go

 			WithVersion(flags.version).
 			WithDomainType(flags.domainType).
 			WithDomain(flags.domain).
 			WithPrivateKey(flags.privateKeyPath, flags.privateKeyPassword).
+			WithOIDCConfig(steps.AuthOIDC, flags.discoveryURL, flags.clientID, flags.clientSecret, true).


given that you are configuring oidc, i think that you dont need passing steps.AuthOIDC,

enekofb · 2023-10-24T09:15:03Z

cmd/gitops/app/bootstrap/cmd.go

 			WithVersion(flags.version).
 			WithDomainType(flags.domainType).
 			WithDomain(flags.domain).
 			WithPrivateKey(flags.privateKeyPath, flags.privateKeyPassword).
+			WithOIDCConfig(steps.AuthOIDC, flags.discoveryURL, flags.clientID, flags.clientSecret, true).


given that you are passing flags.discoveryURL let me know why PromptedForDiscoveryURL is required?

PromptedForDiscoveryURL is to differentiate for the step method where it's called, from the separate command or from within the setup flow. it's responsibe for asking Do you want to setup OIDC to access Weave GitOps Dashboard

pkg/bootstrap/bootstrap.go

pkg/bootstrap/utils/flux.go

enekofb · 2023-10-24T11:01:53Z

pkg/bootstrap/steps/oidc.go

+	if err != nil {
+		return []StepOutput{}, err
+	}
+	c.Logger.Actionf("retrieved issure url: %s", issuerUrl)


Suggested change

c.Logger.Actionf("retrieved issure url: %s", issuerUrl)

c.Logger.Actionf("retrieved issuer url: %s", issuerUrl)

pkg/bootstrap/steps/oidc.go

enekofb · 2023-10-24T11:05:42Z

pkg/bootstrap/steps/oidc.go

+	c.IssuerURL = issuerUrl
+
+	if c.DomainType == domainTypeLocalhost {
+		c.RedirectURL = "http://localhost:8000/oauth2/callback"


what would happen if we are exposing SSL server on 8000 ?

the localhost installation is only HTTP, otherwise it'll require setting up local certificate and a lot of things could go wrong here

enekofb · 2023-10-24T11:06:03Z

pkg/bootstrap/steps/oidc.go

+	if c.DomainType == domainTypeLocalhost {
+		c.RedirectURL = "http://localhost:8000/oauth2/callback"
+	} else {
+		c.RedirectURL = fmt.Sprintf("https://%s/oauth2/callback", c.UserDomain)


what about if the user exposes non https domain?

I think for majority of users exposing https is a must ?, what do you think ?

enekofb · 2023-10-24T11:11:07Z

pkg/bootstrap/steps/oidc.go

+		return []StepOutput{}, err
+	}
+	c.Logger.Actionf("rendered HelmRelease file")
+	c.Logger.Successf(oidcConfirmationMsg)


c.Logger.Successf(oidcConfirmationMsg) given this message if I was a user, I would understand that oidc is ready to use at this stage but actually will be after the reconciliation happens, correct? if that is the case, we could revisit this msg

Samra10 · 2023-10-24T11:45:15Z

cmd/gitops/app/bootstrap/cmd.go

 			WithVersion(flags.version).
 			WithDomainType(flags.domainType).
 			WithDomain(flags.domain).
 			WithPrivateKey(flags.privateKeyPath, flags.privateKeyPassword).
+			WithOIDCConfig(steps.AuthOIDC, flags.discoveryURL, flags.clientID, flags.clientSecret, true).


OIDC can be tested by using the following parameters:-

bootstrap --discovery-url https://dex-01.wge.dev.weave.works/.well-known/openid-configu0ration --client-id weave-gitops-enterprise

These configs are configured on WW dex setup here

We have added two redirect URLs under weave-gitops-enterprise static-client, one to be used if we choose the domain type to be local here and another if external DNS has been chosen here, so if you need to test with a different external DNS you need to add it under one of the static-clients.

cc: @enekofb @waleedhammam

adding this to the PR description

removed client-secret from the description to do not leak it

Acceptance scenarios based on the configuration

scenarios: happy path without previous

As user without existing oidc, I could setup odic with valid arguments via interactive session

As user without existing oidc, I could setup odic with valid arguments via non-interactive flags

scenarios: happy path with previous oidc configuration

As user with existing oidc, I could overwrite odic with valid arguments via interactive session

As user with existing oidc, I could overwrite odic with valid arguments via non-interactive session

scenarios: happy path with previous oidc configuration

As user with existing oidc, I could reuse odic via interactive session

As user with existing oidc, I could reuse odic via non-interactive session

scenarios: unhappy path

As user with existing oidc, I could not setup odic with invalid arguments via interactive session

As user with existing oidc, I could not setup odic with invalid arguments via non-interactive session

Testing Scenario:

As user without existing oidc, I could setup odic with valid arguments via non-interactive flags
Run with the following args

cmd_acceptance_test.go:152: "level"=0 "msg"="execute cmd" "args"=["bootstrap","--kubeconfig=/var/folders/9b/bkrspzws5xgd7x_ldtc880pr0000gn/T/kubeconfig1556281884","--version=0.33.0","--private-key=/Users/enekofb/.ssh/id_ed25519","--private-key-password=""","--username=admin","--password=admin123","--domain-type=localhost","--discovery-url=https://dex-01.wge.dev.weave.works/.well-known/openid-configu0ration --client-id=weave-gitops-enterprise --client-secret="]

and got the following output

◎ reconciling changes ✔ changes are reconciled successfully! ◎ OIDC Configuration ? Do you want to setup OIDC to access Weave GitOps Dashboards? [y/N] █ ✗ Please enter OIDC clientID: █ cmd_acceptance_test.go:159: Expected <*errors.errorString | 0x14000c63510>: cannot execute bootstrap: cannot process input 'OIDC Configuration': ^D { s: "cannot execute bootstrap: cannot process input 'OIDC Configuration': ^D", } to be nil cmd_acceptance_test.go:260: "level"=0 "msg"="deleted object" "name"="weave-gitops-enterprise-credentials" "ns"="flux-system" "kind"="Secret" cmd_acceptance_test.go:260: "level"=0 "msg"="deleted object" "name"="cluster-user-auth" "ns"="flux-system" "kind"="Secret"

Testing Scenario: As user without existing oidc, I could setup odic with valid arguments via interactive session

◎ reconciling changes ✔ changes are reconciled successfully! ◎ OIDC Configuration Do you want to setup OIDC to access Weave GitOps Dashboards: y Please enter OIDC clientSecret: ****************************** ► retrieved issuer url: https://dex-01.wge.dev.weave.works ► setting redirect url: http://localhost:8000/oauth2/callback ◎ Configuring OIDC ► configuring oidc values ► rendered HelmRelease file ✔ OIDC has been configured successfully! It will be ready to use after reconcillation ► updating HelmRelease file ► creating secret: flux-system/oidc-auth ✔ created secret flux-system/oidc-auth ► write file to repo: wge-hrelease.yaml ► cloning flux git repo: flux-system/flux-system ✔ cloned flux git repo: flux-system/flux-system ✔ file committed to repo: wge-hrelease.yaml ◎ reconciling changes ✔ changes are reconciled successfully! ◎ preparing dashboard domain ✔ WGE v0.33.0 is installed successfully. To access the dashboard, run the following command to create portforward to the dasboard local domain http://localhost:8000 kubectl -n flux-system port-forward svc/clusters-service 8000:8000

after that i could login:

but could not see anything:

scenarios: happy path with previous oidc configuration

As user with existing oidc, I could overwrite odic with valid arguments via interactive session

does not finish with both yes

◎ reconciling changes ✔ changes are reconciled successfully! ◎ OIDC Configuration ⚠️ OIDC is already configured on the cluster. To reset configurations please remove secret 'oidc-auth' in namespace 'flux-system' and run 'bootstrap auth --type=oidc' command again Do you want to continue using existing OIDC configurations: y Do you want to setup OIDC to access Weave GitOps Dashboards: y ◎ preparing dashboard domain

does not finish with yes/no-selection

◎ reconciling changes ✔ changes are reconciled successfully! ◎ OIDC Configuration ⚠️ OIDC is already configured on the cluster. To reset configurations please remove secret 'oidc-auth' in namespace 'flux-system' and run 'bootstrap auth --type=oidc' command again Do you want to continue using existing OIDC configurations: y ? Do you want to setup OIDC to access Weave GitOps Dashboards? [y/N] █ ◎ preparing dashboard domain

it finishes with yes and no

✔ file committed to repo: wge-hrelease.yaml ◎ reconciling changes ✔ changes are reconciled successfully! ◎ OIDC Configuration ⚠️ OIDC is already configured on the cluster. To reset configurations please remove secret 'oidc-auth' in namespace 'flux-system' and run 'bootstrap auth --type=oidc' command again Do you want to continue using existing OIDC configurations: y ✗ Do you want to setup OIDC to access Weave GitOps Dashboards: ◎ preparing dashboard domain ✔ WGE v0.33.0 is installed successfully. To access the dashboard, run the following command to create portforward to the dasboard local domain http://localhost:8000 kubectl -n flux-system port-forward svc/clusters-service 8000:8000 ➜

As user with existing oidc, I could overwrite odic with valid arguments via non-interactive session

we cannot

✔ selected version 0.33.0 ◎ user authentication ⚠️ admin login credentials already exist on the cluster. To reset admin credentials please remove secret 'cluster-user-auth' in namespace 'flux-system', then try again do you want to continue using existing credentials: y ◎ dashboard access

enekofb

tested the journeys here: lets discuss it with our session

to add:

support for oidc with acceptance test started here

to follow up:

rbac for oidc (see comment)
story for existing resources for non-interactive user https://weaveworks.slack.com/archives/C05HC9R4DUG/p1698222391488089

enekofb · 2023-10-25T07:09:42Z

pkg/bootstrap/steps/oidc.go

+
+func OIDCConfigStep(config Config) BootstrapStep {
+
+	inputs := []StepInput{


if this is the case

in case of non-interactive. he should see that anyway

it breaks the contract, a non-interactive user wont be able to use it.

enekofb · 2023-10-25T07:18:48Z

cmd/gitops/app/bootstrap/cmd.go

 			WithVersion(flags.version).
 			WithDomainType(flags.domainType).
 			WithDomain(flags.domain).
 			WithPrivateKey(flags.privateKeyPath, flags.privateKeyPassword).
+			WithOIDCConfig(steps.AuthOIDC, flags.discoveryURL, flags.clientID, flags.clientSecret, true).


Acceptance scenarios based on the configuration

scenarios: happy path without previous

As user without existing oidc, I could setup odic with valid arguments via interactive session

As user without existing oidc, I could setup odic with valid arguments via non-interactive flags

scenarios: happy path with previous oidc configuration

As user with existing oidc, I could overwrite odic with valid arguments via interactive session

As user with existing oidc, I could overwrite odic with valid arguments via non-interactive session

scenarios: happy path with previous oidc configuration

As user with existing oidc, I could reuse odic via interactive session

As user with existing oidc, I could reuse odic via non-interactive session

scenarios: unhappy path

As user with existing oidc, I could not setup odic with invalid arguments via interactive session

As user with existing oidc, I could not setup odic with invalid arguments via non-interactive session

enekofb · 2023-10-25T07:58:27Z

cmd/gitops/app/bootstrap/cmd.go

 			WithVersion(flags.version).
 			WithDomainType(flags.domainType).
 			WithDomain(flags.domain).
 			WithPrivateKey(flags.privateKeyPath, flags.privateKeyPassword).
+			WithOIDCConfig(steps.AuthOIDC, flags.discoveryURL, flags.clientID, flags.clientSecret, true).


Testing Scenario:

As user without existing oidc, I could setup odic with valid arguments via non-interactive flags
Run with the following args

cmd_acceptance_test.go:152: "level"=0 "msg"="execute cmd" "args"=["bootstrap","--kubeconfig=/var/folders/9b/bkrspzws5xgd7x_ldtc880pr0000gn/T/kubeconfig1556281884","--version=0.33.0","--private-key=/Users/enekofb/.ssh/id_ed25519","--private-key-password=""","--username=admin","--password=admin123","--domain-type=localhost","--discovery-url=https://dex-01.wge.dev.weave.works/.well-known/openid-configu0ration --client-id=weave-gitops-enterprise --client-secret="]

and got the following output

◎ reconciling changes ✔ changes are reconciled successfully! ◎ OIDC Configuration ? Do you want to setup OIDC to access Weave GitOps Dashboards? [y/N] █ ✗ Please enter OIDC clientID: █ cmd_acceptance_test.go:159: Expected <*errors.errorString | 0x14000c63510>: cannot execute bootstrap: cannot process input 'OIDC Configuration': ^D { s: "cannot execute bootstrap: cannot process input 'OIDC Configuration': ^D", } to be nil cmd_acceptance_test.go:260: "level"=0 "msg"="deleted object" "name"="weave-gitops-enterprise-credentials" "ns"="flux-system" "kind"="Secret" cmd_acceptance_test.go:260: "level"=0 "msg"="deleted object" "name"="cluster-user-auth" "ns"="flux-system" "kind"="Secret"

cmd/gitops/app/bootstrap/cmd.go

enekofb · 2023-10-25T08:18:03Z

cmd/gitops/app/bootstrap/cmd.go

 			WithVersion(flags.version).
 			WithDomainType(flags.domainType).
 			WithDomain(flags.domain).
 			WithPrivateKey(flags.privateKeyPath, flags.privateKeyPassword).
+			WithOIDCConfig(steps.AuthOIDC, flags.discoveryURL, flags.clientID, flags.clientSecret, true).


Testing Scenario: As user without existing oidc, I could setup odic with valid arguments via interactive session

◎ reconciling changes ✔ changes are reconciled successfully! ◎ OIDC Configuration Do you want to setup OIDC to access Weave GitOps Dashboards: y Please enter OIDC clientSecret: ****************************** ► retrieved issuer url: https://dex-01.wge.dev.weave.works ► setting redirect url: http://localhost:8000/oauth2/callback ◎ Configuring OIDC ► configuring oidc values ► rendered HelmRelease file ✔ OIDC has been configured successfully! It will be ready to use after reconcillation ► updating HelmRelease file ► creating secret: flux-system/oidc-auth ✔ created secret flux-system/oidc-auth ► write file to repo: wge-hrelease.yaml ► cloning flux git repo: flux-system/flux-system ✔ cloned flux git repo: flux-system/flux-system ✔ file committed to repo: wge-hrelease.yaml ◎ reconciling changes ✔ changes are reconciled successfully! ◎ preparing dashboard domain ✔ WGE v0.33.0 is installed successfully. To access the dashboard, run the following command to create portforward to the dasboard local domain http://localhost:8000 kubectl -n flux-system port-forward svc/clusters-service 8000:8000

after that i could login:

but could not see anything:

enekofb · 2023-10-25T08:33:53Z

cmd/gitops/app/bootstrap/cmd.go

 			WithVersion(flags.version).
 			WithDomainType(flags.domainType).
 			WithDomain(flags.domain).
 			WithPrivateKey(flags.privateKeyPath, flags.privateKeyPassword).
+			WithOIDCConfig(steps.AuthOIDC, flags.discoveryURL, flags.clientID, flags.clientSecret, true).


scenarios: happy path with previous oidc configuration

As user with existing oidc, I could overwrite odic with valid arguments via interactive session

does not finish with both yes

◎ reconciling changes ✔ changes are reconciled successfully! ◎ OIDC Configuration ⚠️ OIDC is already configured on the cluster. To reset configurations please remove secret 'oidc-auth' in namespace 'flux-system' and run 'bootstrap auth --type=oidc' command again Do you want to continue using existing OIDC configurations: y Do you want to setup OIDC to access Weave GitOps Dashboards: y ◎ preparing dashboard domain

does not finish with yes/no-selection

◎ reconciling changes ✔ changes are reconciled successfully! ◎ OIDC Configuration ⚠️ OIDC is already configured on the cluster. To reset configurations please remove secret 'oidc-auth' in namespace 'flux-system' and run 'bootstrap auth --type=oidc' command again Do you want to continue using existing OIDC configurations: y ? Do you want to setup OIDC to access Weave GitOps Dashboards? [y/N] █ ◎ preparing dashboard domain

it finishes with yes and no

✔ file committed to repo: wge-hrelease.yaml ◎ reconciling changes ✔ changes are reconciled successfully! ◎ OIDC Configuration ⚠️ OIDC is already configured on the cluster. To reset configurations please remove secret 'oidc-auth' in namespace 'flux-system' and run 'bootstrap auth --type=oidc' command again Do you want to continue using existing OIDC configurations: y ✗ Do you want to setup OIDC to access Weave GitOps Dashboards: ◎ preparing dashboard domain ✔ WGE v0.33.0 is installed successfully. To access the dashboard, run the following command to create portforward to the dasboard local domain http://localhost:8000 kubectl -n flux-system port-forward svc/clusters-service 8000:8000 ➜

As user with existing oidc, I could overwrite odic with valid arguments via non-interactive session

we cannot

✔ selected version 0.33.0 ◎ user authentication ⚠️ admin login credentials already exist on the cluster. To reset admin credentials please remove secret 'cluster-user-auth' in namespace 'flux-system', then try again do you want to continue using existing credentials: y ◎ dashboard access

waleedhammam · 2023-10-25T12:10:25Z

fixed the OIDC prompt
start using default flag for continue with existing data shall be in the followup

* added oidc scenario * can run acceptance on oidc

enekofb

🚀

Followups

https://github.com/weaveworks/weave-gitops-enterprise/pull/3399/files#r1368358114
user documentation
testing withOidcConfig
test for when we are not running localhost:8000 but localhost:9000
acceptance scenarios for non-happy path #3399 (comment)
extract domain logic out of oidc step https://github.com/weaveworks/weave-gitops-enterprise/pull/3399/files#r1369984602
single step for oidc, we have now two

enekofb · 2023-10-26T08:20:36Z

pkg/bootstrap/steps/config.go

@@ -97,6 +112,18 @@ func (c *ConfigBuilder) WithPrivateKey(privateKeyPath string, privateKeyPassword
 	return c
 }

+func (c *ConfigBuilder) WithOIDCConfig(discoveryURL string, clientID string, clientSecret string, prompted bool) *ConfigBuilder {


followup: add testing for this logic as we setup expectations that if arguments are passed means that we want to install oidc which is an implicit contract

enekofb · 2023-10-26T08:22:41Z

pkg/bootstrap/steps/config.go

@@ -97,6 +112,18 @@ func (c *ConfigBuilder) WithPrivateKey(privateKeyPath string, privateKeyPassword
 	return c
 }

+func (c *ConfigBuilder) WithOIDCConfig(discoveryURL string, clientID string, clientSecret string, prompted bool) *ConfigBuilder {
+	c.authType = AuthOIDC


followup: add this as argument

pkg/bootstrap/steps/oidc.go

no longer relevant

waleedhammam and others added 30 commits August 6, 2023 12:22

init gitops bootstrap command for wge

24c84b1

add checks for entitlement and flux

5790b43

Merge branch 'main' into 3165-onboarding-cli-mvp

06ee477

Add wge version choise list

7dd9d30

Merge branch 'main' into 3165-onboarding-cli-mvp

9b56a86

add create admin username and password secret

a0f4806

add install wge

1113f4e

fix adding admin password

53e4f69

Merge branch 'main' into 3165-onboarding-cli-mvp

a11f30a

fix linting

d35124d

Merge branch 'main' into 3165-onboarding-cli-mvp

970a1c7

run go mod tidy

17282df

enable ingress

ab79c4e

add domain type selector

8c978f6

Merge branch 'main' into 3165-onboarding-cli-mvp

3d5d643

add option to bootstrap flux

0b55a06

adjust bootstraping flux and domain

f7f2f56

add install extra controllers

678dc19

fix lint

a960f85

Merge branch 'main' into 3165-onboarding-cli-mvp

b6edbb6

rename package checks to commands

62b7af5

refactor packages

6ed6f18

early exit

10c1b06

refactor errors and add utils for git repos

4c8b1f2

refactor wge installation to use files

9767330

refactor extra controllers

62d97c3

remove extra unneeded values

589d1b3

Add OIDC

c34ea30

update portforward

b41df39

add admin password revert

719026d

waleedhammam requested a review from enekofb October 22, 2023 08:34

enekofb reviewed Oct 23, 2023

View reviewed changes

cmd/gitops/app/bootstrap/cmd.go Show resolved Hide resolved

Merge branch 'main' into oidc-flow-update

a129bdd

waleedhammam mentioned this pull request Oct 23, 2023

bootstrap CLI: create a single step Auth that consolidates both cluster-user and oidc #3535

Open

Merge branch 'main' into oidc-flow-update

12991b2

enekofb reviewed Oct 24, 2023

View reviewed changes

Samra10 commented Oct 24, 2023

View reviewed changes

waleedhammam added 3 commits October 24, 2023 14:52

Merge branch 'main' into oidc-flow-update

5d1b8c2

add unit tests and address review comments

b3d5aaf

remove leftover variable

ec97faa

waleedhammam requested a review from enekofb October 24, 2023 12:41

Merge branch 'main' into oidc-flow-update

cd134ea

enekofb reviewed Oct 25, 2023

View reviewed changes

waleedhammam added 3 commits October 25, 2023 14:30

Merge branch 'main' into oidc-flow-update

ce963b4

fix oidc prompt

fb69f5b

add example to start with oidc

3c7c79b

waleedhammam requested a review from enekofb October 25, 2023 12:10

enekofb and others added 5 commits October 26, 2023 09:08

added oidc scenario (#3543)

32ed02e

* added oidc scenario * can run acceptance on oidc

Merge branch 'main' into oidc-flow-update

7e57459

fix oidc prompt for existing creds

ff3f5fb

Merge branch 'main' into oidc-flow-update

20850ec

fix oidc domaintype

5088f08

waleedhammam force-pushed the oidc-flow-update branch from 3a263c2 to 5088f08 Compare October 26, 2023 10:56

waleedhammam added 2 commits October 26, 2023 13:56

modify log message

8de12e9

modify log message

a3eda22

enekofb approved these changes Oct 26, 2023

View reviewed changes

waleedhammam merged commit 6912a53 into main Oct 26, 2023

waleedhammam deleted the oidc-flow-update branch October 26, 2023 11:13

	c.Logger.Actionf("retrieved issure url: %s", issuerUrl)
	c.Logger.Actionf("retrieved issuer url: %s", issuerUrl)


		func OIDCConfigStep(config Config) BootstrapStep {

		inputs := []StepInput{

Add OIDC to bootstrap CLI #3399

Add OIDC to bootstrap CLI #3399

Uh oh!

Conversation

Samra10 commented Sep 25, 2023 • edited by enekofb Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

enekofb left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Samra10 Oct 24, 2023 • edited by enekofb Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

enekofb left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

waleedhammam commented Oct 25, 2023

Uh oh!

enekofb left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Samra10 commented Sep 25, 2023 •

edited by enekofb

Loading

Samra10 Oct 24, 2023 •

edited by enekofb

Loading

enekofb left a comment •

edited

Loading

enekofb left a comment •

edited

Loading