feat: kubernetes tokens #147

nurtai325 · 2025-10-12T10:15:44Z

No description provided.

ArkuNC · 2025-10-15T09:20:49Z

...ain/java/com/netcracker/cloud/dbaas/config/security/KubernetesJWTCallerPrincipalFactory.java

+    @Override
+    public JWTCallerPrincipal parse(String token, JWTAuthContextInfo authContextInfo) throws ParseException {
+        try {
+            var prin = new DefaultJWTCallerPrincipal(verifier.verify(token));


Can be directly returned without saving to variable.

ArkuNC · 2025-10-15T09:23:45Z

...a/com/netcracker/cloud/dbaas/controller/v3/AggregatedDatabaseAdministrationControllerV3.java

            throw new InvalidClassifierException("Invalid V3 classifier", classifierRequest.getClassifier(), Source.builder().pointer("").build());
        }
+        checkTenantId(classifierRequest.getClassifier());
        checkOriginService(classifierRequest);


Remove the duplicated check.

ArkuNC · 2025-10-15T09:28:12Z

...a/com/netcracker/cloud/dbaas/controller/v3/AggregatedDatabaseAdministrationControllerV3.java

-            throw new InvalidClassifierException("Classifier doesn't contain all mandatory fields. " +
-                    "Check that classifier has `microserviceName`, `scope`. If `scope` = `tenant`, classifier must contain `tenantId` property",
-                    createRequest.getClassifier(), Source.builder().pointer("/classifier").build());
+        if (!AggregatedDatabaseAdministrationService.AggregatedDatabaseAdministrationUtils.isClassifierCorrect(createRequest.getClassifier()) ||


Let's split these two checks and throw different exception messages for them (in all similar cases).

ArkuNC · 2025-10-15T09:47:53Z

...in/java/com/netcracker/cloud/dbaas/security/validators/NamespaceValidationRequestFilter.java

+            return;
+        }
+        if (!namespaceValidator.checkNamespaceIsolation(namespaceFromPath, JwtUtils.getNamespace(requestContext.getSecurityContext()))) {
+            requestContext.abortWith(Response.status(Response.Status.FORBIDDEN.getStatusCode(), "Namespace from path and namespace from jwt token doesn't not match or aren't in the same composite structure").build());


Should be in the TMF format (com.netcracker.cloud.dbaas.controller.error.Utils).

ArkuNC · 2025-10-15T10:39:43Z

...gregator/src/main/java/com/netcracker/cloud/dbaas/security/ServiceAccountRolesAugmentor.java

+        }
+
+        String principal = identity.getPrincipal().getName();
+        String serviceName = principal.substring(principal.lastIndexOf(':') + 1);


Please add Javadoc or something to describe in which format we're expecting the "principal" structure.

ArkuNC · 2025-10-15T11:05:14Z

...aggregator/src/main/java/com/netcracker/cloud/dbaas/security/ServiceAccountRolesManager.java

+@NoArgsConstructor
+@Slf4j
+public class ServiceAccountRolesManager {
+    private final ArrayList<ServiceAccountWithRoles> serviceAccountsWithRoles = new ArrayList<>();


Why it's a List if it's used only as a Map (searching by key)? Can we make it a Map instead? Then we can even remove ServiceAccountWithRoles dto.

i thought arraylist would be much more performant and require less memory since there will only be a few items. Should I change it to a map?

ArkuNC · 2025-10-15T11:10:46Z

...gregator/src/main/java/com/netcracker/cloud/dbaas/service/DbaasAdapterRESTClientFactory.java

+
    @Inject
    TimeMeasurementManager timeMeasurementManager;
+    KubernetesTokenAuthFilter kubernetesTokenAuthFilter;


Why it's a field instead of a local variable?

ArkuNC · 2025-10-15T11:36:49Z

...ain/java/com/netcracker/cloud/dbaas/config/security/KubernetesJWTCallerPrincipalFactory.java

+
+    @Inject
+    public KubernetesJWTCallerPrincipalFactory(
+            @ConfigProperty(name = "dbaas.security.k8s.jwt.enabled") boolean isJwtEnabled,


Prefix "is" should be used only for methods that return boolean value. Parameters/variables should be without it, like "jwtEnabled".

fixed in other places too

ArkuNC · 2025-10-15T11:37:46Z

...gregator/src/main/java/com/netcracker/cloud/dbaas/service/DbaasAdapterRESTClientFactory.java

 public class DbaasAdapterRESTClientFactory {
+    @Inject
+    @ConfigProperty(name = "dbaas.security.k8s.jwt.enabled")
+    boolean isJwtEnabled;


Prefix "is" should be used only for methods that return boolean value. Parameters/variables should be without it, like "jwtEnabled".

ArkuNC · 2025-10-15T11:42:59Z

...est/java/com/netcracker/cloud/dbaas/config/security/BasicAndKubernetesAuthMechanismTest.java

+
+        Uni<ChallengeData> result = mechanism.getChallenge(context);
+
+        verify(jwtAuth, times(1)).getChallenge(any());


In the previous tests you have checked that the opposite auth method was not called. Can we add such check in this and following tests also?

ArkuNC · 2025-10-15T11:46:11Z

...est/java/com/netcracker/cloud/dbaas/config/security/BasicAndKubernetesAuthMechanismTest.java

+        Set<Class<? extends AuthenticationRequest>> result = mechanism.getCredentialTypes();
+
+        assertNotNull(result);
+        assertTrue(result.contains(AuthenticationRequest.class));


This is not sufficient for checking that "result" contains types from both auth methods.

ArkuNC · 2025-10-15T11:57:34Z

...java/com/netcracker/cloud/dbaas/config/security/KubernetesJWTCallerPrincipalFactoryTest.java

+import static org.junit.jupiter.api.Assertions.*;
+
+@ExtendWith(MockitoExtension.class)
+class KubernetesJWTCallerPrincipalFactoryTest {


Need to add a test for correct operation of "isJwtEnabled" constructor parameter.

ArkuNC · 2025-10-15T12:40:54Z

...egator/src/test/java/com/netcracker/cloud/dbaas/rest/SecureDbaasAdapterRestClientV2Test.java

+    private AuthFilterSelector authFilterSelector;
+
+    @Test
+    void shouldExecuteRequestWithBasicAuthWhenJwtDisabled() {


Here we not actually checked that request was performed with basic auth.

ArkuNC · 2025-10-15T12:41:51Z

...egator/src/test/java/com/netcracker/cloud/dbaas/integration/config/MockOidcTestResource.java

+import static com.github.tomakehurst.wiremock.client.WireMock.*;
+
+@Slf4j
+public class MockOidcTestResource implements QuarkusTestResourceLifecycleManager {


We shouldn't just copypaste part of existing Quarkus class. Please find a way to use OidcWiremockTestResource correctly.

ArkuNC · 2025-10-15T12:46:27Z

...egator/src/test/java/com/netcracker/cloud/dbaas/rest/SecureDbaasAdapterRestClientV2Test.java

+        verify(restClient).close();
+    }
+
+    private Response.StatusType getStatusType(int code) {


"code" parameter is not used, and 403 code is hardcoded.

ArkuNC · 2025-10-15T12:50:23Z

...tor/src/test/java/com/netcracker/cloud/dbaas/security/validators/NamespaceValidatorTest.java

+
+        when(compositeNamespaceService.getBaselineByNamespace(defaultNamespace)).thenReturn(Optional.of(defaultBaseLine));
+        when(compositeNamespaceService.getBaselineByNamespace(otherNamespaceInComposite)).thenReturn(Optional.of(defaultBaseLine));
+        when(compositeNamespaceService.getBaselineByNamespace("someOtherNamespace")).thenReturn(Optional.empty());


Why some of the strings are stored in fields, and some are in code? Let's move all of them to fields.

I thought that this way it would be more clear that this is not a predefined namespace but "someOtherNamespace"

ArkuNC · 2025-10-15T12:51:01Z

...ator/src/test/java/com/netcracker/cloud/dbaas/security/ServiceAccountRolesAugmentorTest.java

+    ServiceAccountRolesAugmentor augmentor;
+
+    @BeforeEach
+    void setUp() {


Empty lifecycle methods are not needed.

asatt · 2025-11-27T11:56:16Z

dbaas/dbaas-aggregator/src/main/java/com/netcracker/cloud/dbaas/exceptions/ErrorCodes.java

                    "Must be in format: <schema>://<service-name>.<namespace>:<port>, e.g.: http://dbaas-postgres-adapter.postgresql:8080"),
+    CORE_DBAAS_4046(
+            "CORE-DBAAS-4046",
+            "Invalid tenantId in classifier",


Error message should be more descriptive about what constitutes an invalid tenantId.

Suggested change

"Invalid tenantId in classifier",

"Tenant ID mismatch in classifier",

#deepseek-review:inline

asatt · 2025-11-27T11:56:16Z

dbaas/dbaas-aggregator/src/main/java/com/netcracker/cloud/dbaas/exceptions/ErrorCodes.java

            "Adapter address name has wrong format",
            "register request contains adapter address field, but it has wrong format: %s. " +
                    "Must be in format: <schema>://<service-name>.<namespace>:<port>, e.g.: http://dbaas-postgres-adapter.postgresql:8080"),
+    CORE_DBAAS_4046(


Error code CORE_DBAAS_4046 should follow the established naming pattern with consistent spacing.

Suggested change

CORE_DBAAS_4046(

CORE_DBAAS_4046(

#deepseek-review:inline

asatt · 2025-11-27T11:56:16Z

dbaas/dbaas-aggregator/src/main/java/com/netcracker/cloud/dbaas/exceptions/ErrorCodes.java

            "register request contains adapter address field, but it has wrong format: %s. " +
                    "Must be in format: <schema>://<service-name>.<namespace>:<port>, e.g.: http://dbaas-postgres-adapter.postgresql:8080"),
+    CORE_DBAAS_4046(
+            "CORE-DBAAS-4046",


Error code string should be consistent with the pattern used in other error codes.

Suggested change

"CORE-DBAAS-4046",

"CORE-DBAAS-4046",

#deepseek-review:inline

asatt · 2025-11-27T11:56:16Z

dbaas/dbaas-aggregator/src/main/java/com/netcracker/cloud/dbaas/exceptions/ErrorCodes.java

+    CORE_DBAAS_4046(
+            "CORE-DBAAS-4046",
+            "Invalid tenantId in classifier",
+            "tenantId from classifier and tenantId from request don't match"),


Error description should be more specific about the nature of the mismatch.

Suggested change

"tenantId from classifier and tenantId from request don't match"),

"Tenant ID from classifier does not match tenant ID from request"),

#deepseek-review:inline

asatt · 2025-11-27T11:56:17Z

...gregator/src/main/java/com/netcracker/cloud/dbaas/exceptions/InvalidClassifierException.java

    }
+
+    public static InvalidClassifierException withDefaultMsg(Map<String, Object> classifier) {
+        return new InvalidClassifierException("Classifier doesn't contain all mandatory fields. " +


The error message string concatenation is inefficient and hard to read; use a single string literal instead.

Suggested change

return new InvalidClassifierException("Classifier doesn't contain all mandatory fields. " +

return new InvalidClassifierException("Classifier doesn't contain all mandatory fields. If authenticating with token, namespace in classifier and in token must be equal or be in the same composite structure. Check that classifier has `microserviceName`, `scope`. If `scope` = `tenant`, classifier must contain `tenantId` property",

#deepseek-review:inline

asatt · 2025-11-27T11:56:18Z

...dbaas-aggregator/src/main/java/com/netcracker/cloud/dbaas/exceptions/ForbiddenException.java

+import com.netcracker.cloud.core.error.runtime.ErrorCode;
+import com.netcracker.cloud.core.error.runtime.ErrorCodeException;
+
+public class ForbiddenException extends ErrorCodeException {


Consider adding a class-level Javadoc comment to explain the purpose and usage of this exception.

#deepseek-review:inline

asatt · 2025-11-27T11:56:18Z

...dbaas-aggregator/src/main/java/com/netcracker/cloud/dbaas/exceptions/ForbiddenException.java

+import com.netcracker.cloud.core.error.runtime.ErrorCodeException;
+
+public class ForbiddenException extends ErrorCodeException {
+    public ForbiddenException(ErrorCode errorCode, String detail) {


Consider adding parameter validation to ensure errorCode and detail are not null.

Suggested change

public ForbiddenException(ErrorCode errorCode, String detail) {

public ForbiddenException(ErrorCode errorCode, String detail) {

super(Objects.requireNonNull(errorCode, "errorCode must not be null"), Objects.requireNonNull(detail, "detail must not be null"));

}

#deepseek-review:inline

asatt · 2025-11-27T11:56:18Z

...a/com/netcracker/cloud/dbaas/controller/v3/AggregatedDatabaseAdministrationControllerV3.java

-            throw new InvalidClassifierException("Classifier doesn't contain all mandatory fields. " +
-                    "Check that classifier has `microserviceName`, `scope`. If `scope` = `tenant`, classifier must contain `tenantId` property",
-                    externalDatabaseRequest.getClassifier(), Source.builder().pointer("/classifier").build());
+        if (!AggregatedDatabaseAdministrationService.AggregatedDatabaseAdministrationUtils.isClassifierCorrect(externalDatabaseRequest.getClassifier()) || !namespaceValidator.checkNamespaceFromClassifier(securityContext, externalDatabaseRequest.getClassifier())) {


Split long conditional expression into separate statements for clarity.

#deepseek-review:inline

asatt · 2025-11-27T11:56:18Z

...a/com/netcracker/cloud/dbaas/controller/v3/AggregatedDatabaseAdministrationControllerV3.java

+        if (!Objects.equals(classifier.get(SCOPE), SCOPE_VALUE_TENANT)) {
+            return;
+        }
+        String tenantId = ((TenantContextObject) ContextManager.get(BaseTenantProvider.TENANT_CONTEXT_NAME)).getTenant();


Add null check for ContextManager.get result to prevent ClassCastException.

Suggested change

String tenantId = ((TenantContextObject) ContextManager.get(BaseTenantProvider.TENANT_CONTEXT_NAME)).getTenant();

TenantContextObject tenantContext = (TenantContextObject) ContextManager.get(BaseTenantProvider.TENANT_CONTEXT_NAME);

if (tenantContext == null || !tenantId.equals(classifier.get(TENANT_ID))) {

#deepseek-review:inline

asatt · 2025-11-27T11:56:18Z

...a/com/netcracker/cloud/dbaas/controller/v3/AggregatedDatabaseAdministrationControllerV3.java

-                    createRequest.getClassifier(), Source.builder().pointer("/classifier").build());
+        if (!AggregatedDatabaseAdministrationService.AggregatedDatabaseAdministrationUtils.isClassifierCorrect(createRequest.getClassifier()) ||
+                !namespaceValidator.checkNamespaceFromClassifier(securityContext, createRequest.getClassifier())) {
+            throw InvalidClassifierException.withDefaultMsg(createRequest.getClassifier());


Use specific exception messages instead of generic ones to help with debugging.

#deepseek-review:inline

asatt · 2025-11-27T11:56:18Z

...a/com/netcracker/cloud/dbaas/controller/v3/AggregatedDatabaseAdministrationControllerV3.java

    }

    private void checkOriginService(UserRolesServices rolesServices) {
+        if (securityContext.getUserPrincipal() instanceof DefaultJWTCallerPrincipal principal) {


Add null check for securityContext.getUserPrincipal() to prevent potential NPE.

Suggested change

if (securityContext.getUserPrincipal() instanceof DefaultJWTCallerPrincipal principal) {

if (securityContext.getUserPrincipal() != null && securityContext.getUserPrincipal() instanceof DefaultJWTCallerPrincipal principal) {

#deepseek-review:inline

asatt · 2025-11-27T11:56:18Z

...a/com/netcracker/cloud/dbaas/controller/v3/AggregatedDatabaseAdministrationControllerV3.java

+        if (!Objects.equals(classifier.get(SCOPE), SCOPE_VALUE_TENANT)) {
+            return;
+        }
+        String tenantId = ((TenantContextObject) ContextManager.get(BaseTenantProvider.TENANT_CONTEXT_NAME)).getTenant();


Extract tenant ID retrieval into a separate method for reusability.

#deepseek-review:inline

asatt · 2025-11-27T11:56:18Z

...a/com/netcracker/cloud/dbaas/controller/v3/AggregatedDatabaseAdministrationControllerV3.java

                                            @PathParam("type") String type) {
-        checkOriginService(classifierRequest);
-        if (!dBaaService.isValidClassifierV3(classifierRequest.getClassifier())) {
+        if (!dBaaService.isValidClassifierV3(classifierRequest.getClassifier()) || !namespaceValidator.checkNamespaceFromClassifier(securityContext, classifierRequest.getClassifier())) {


Split complex conditional into separate if statements for better maintainability.

#deepseek-review:inline

asatt · 2025-11-27T11:56:18Z

...a/com/netcracker/cloud/dbaas/controller/v3/AggregatedDatabaseAdministrationControllerV3.java

-            throw new InvalidClassifierException("Classifier doesn't contain all mandatory fields. " +
-                    "Check that classifier has `microserviceName`, `scope`. If `scope` = `tenant`, classifier must contain `tenantId` property",
-                    createRequest.getClassifier(), Source.builder().pointer("/classifier").build());
+        if (!AggregatedDatabaseAdministrationService.AggregatedDatabaseAdministrationUtils.isClassifierCorrect(createRequest.getClassifier()) ||


Combine multiple validation conditions into separate if statements for better readability.

#deepseek-review:inline

asatt · 2025-11-27T11:56:24Z

...aggregator/src/main/java/com/netcracker/cloud/dbaas/security/filters/AuthFilterSelector.java

+public interface AuthFilterSelector {
+    void selectAuthFilter(ClientRequestFilter authFilter);
+
+    ClientRequestFilter getAuthFilter();


Consider adding nullability annotations to clarify if getAuthFilter() can return null.

#deepseek-review:inline

asatt · 2025-11-27T11:56:24Z

...aggregator/src/main/java/com/netcracker/cloud/dbaas/security/filters/AuthFilterSelector.java

+import jakarta.ws.rs.client.ClientRequestFilter;
+
+public interface AuthFilterSelector {
+    void selectAuthFilter(ClientRequestFilter authFilter);


Method name 'selectAuthFilter' suggests selection but implementation sets a single filter, consider renaming to 'setAuthFilter' for clarity.

Suggested change

void selectAuthFilter(ClientRequestFilter authFilter);

void setAuthFilter(ClientRequestFilter authFilter);

#deepseek-review:inline

asatt · 2025-11-27T11:56:26Z

...tor/src/main/java/com/netcracker/cloud/dbaas/security/filters/KubernetesTokenAuthFilter.java

+
+    @Override
+    public void filter(ClientRequestContext clientRequestContext) throws IOException {
+        clientRequestContext.getHeaders().add(HttpHeaders.AUTHORIZATION, "Bearer " + tokenSupplier.get());


Add null check for tokenSupplier.get() to prevent potential NullPointerException when token is null.

Suggested change

clientRequestContext.getHeaders().add(HttpHeaders.AUTHORIZATION, "Bearer " + tokenSupplier.get());

String token = tokenSupplier.get();

if (token != null) {

clientRequestContext.getHeaders().add(HttpHeaders.AUTHORIZATION, "Bearer " + token);

}

#deepseek-review:inline

asatt · 2025-11-27T11:56:28Z

...gregator/src/main/java/com/netcracker/cloud/dbaas/security/ServiceAccountRolesAugmentor.java

+    @Inject
+    ServiceAccountRolesManager rolesManager;
+
+    public ServiceAccountRolesAugmentor(ServiceAccountRolesManager rolesManager) {


Constructor injection is redundant when field injection is already used.

#deepseek-review:inline

asatt · 2025-11-27T11:56:28Z

...gregator/src/main/java/com/netcracker/cloud/dbaas/security/ServiceAccountRolesAugmentor.java

+        Set<String> roles = rolesManager.getRolesByServiceAccountName(serviceName);
+
+        QuarkusSecurityIdentity.Builder builder = QuarkusSecurityIdentity.builder(identity);
+        if (roles != null && !roles.isEmpty()) {


Condition 'roles != null && !roles.isEmpty()' can be simplified to 'roles != null && !roles.isEmpty()' for consistency, but current logic is acceptable.

#deepseek-review:inline

asatt · 2025-11-27T11:56:28Z

...gregator/src/main/java/com/netcracker/cloud/dbaas/security/ServiceAccountRolesAugmentor.java

+        }
+
+        String principal = identity.getPrincipal().getName();
+        String serviceName = principal.substring(principal.lastIndexOf(':') + 1);


Extracting service name from principal may fail if ':' is not present, causing StringIndexOutOfBoundsException.

#deepseek-review:inline

asatt · 2025-11-27T11:56:28Z

...gregator/src/main/java/com/netcracker/cloud/dbaas/security/ServiceAccountRolesAugmentor.java

+        if (roles != null && !roles.isEmpty()) {
+            builder.addRoles(roles);
+        } else {
+            builder.addRole(Constants.DB_CLIENT);


Adding a default role when no roles are found may mask configuration issues; consider logging a warning.

#deepseek-review:inline

asatt · 2025-11-27T11:56:28Z

...gregator/src/main/java/com/netcracker/cloud/dbaas/security/ServiceAccountRolesAugmentor.java

+
+        String principal = identity.getPrincipal().getName();
+        String serviceName = principal.substring(principal.lastIndexOf(':') + 1);
+        Set<String> roles = rolesManager.getRolesByServiceAccountName(serviceName);


rolesManager.getRolesByServiceAccountName may return null; consider handling null explicitly for clarity.

#deepseek-review:inline

feat: kubernetes tokens

472c512

nurtai325 requested a review from lis0x90 as a code owner October 12, 2025 10:15

github-actions bot added the enhancement New feature or request label Oct 12, 2025

nurtai325 self-assigned this Oct 12, 2025

nurtai325 requested review from ArkuNC and iglin October 12, 2025 10:16

fix: injecting property to a private member

8db919a

github-actions bot added the bug Something isn't working label Oct 12, 2025

nurtai325 marked this pull request as draft October 12, 2025 13:46

nurtai325 added 2 commits October 14, 2025 21:13

feat: service account roles secret and volume in helm deployments

8a4753b

chore:reformat

fb180b5

nurtai325 marked this pull request as ready for review October 14, 2025 16:16

ArkuNC reviewed Oct 15, 2025

View reviewed changes

chore: refactoring

fa92156

asatt reviewed Nov 27, 2025

View reviewed changes

nurtai325 added 2 commits January 14, 2026 14:50

chore: refactoring

3711118

Merge branch 'main' into feat/k8s-token-auth

d2d711c

nurtai325 marked this pull request as ready for review January 14, 2026 10:07

nurtai325 added 5 commits January 14, 2026 15:18

chore: refactoring

681a91b

chore: refactoring

a516ba9

chore: refactoring

1704a49

fix: don't copy from OidcWiremockTestResource and use it right

4c77c4a

chore: refactoring

c4e58a1


		Uni<ChallengeData> result = mechanism.getChallenge(context);

		verify(jwtAuth, times(1)).getChallenge(any());

	"Invalid tenantId in classifier",
	"Tenant ID mismatch in classifier",

	"tenantId from classifier and tenantId from request don't match"),
	"Tenant ID from classifier does not match tenant ID from request"),

	return new InvalidClassifierException("Classifier doesn't contain all mandatory fields. " +
	return new InvalidClassifierException("Classifier doesn't contain all mandatory fields. If authenticating with token, namespace in classifier and in token must be equal or be in the same composite structure. Check that classifier has `microserviceName`, `scope`. If `scope` = `tenant`, classifier must contain `tenantId` property",

	String tenantId = ((TenantContextObject) ContextManager.get(BaseTenantProvider.TENANT_CONTEXT_NAME)).getTenant();
	TenantContextObject tenantContext = (TenantContextObject) ContextManager.get(BaseTenantProvider.TENANT_CONTEXT_NAME);
	if (tenantContext == null \|\| !tenantId.equals(classifier.get(TENANT_ID))) {

	if (securityContext.getUserPrincipal() instanceof DefaultJWTCallerPrincipal principal) {
	if (securityContext.getUserPrincipal() != null && securityContext.getUserPrincipal() instanceof DefaultJWTCallerPrincipal principal) {

	void selectAuthFilter(ClientRequestFilter authFilter);
	void setAuthFilter(ClientRequestFilter authFilter);

-        clientRequestContext.getHeaders().add(HttpHeaders.AUTHORIZATION, "Bearer " + tokenSupplier.get());
+        String token = tokenSupplier.get();
+        if (token != null) {
+            clientRequestContext.getHeaders().add(HttpHeaders.AUTHORIZATION, "Bearer " + token);
+        }

feat: kubernetes tokens #147

Are you sure you want to change the base?

feat: kubernetes tokens #147

Uh oh!

Conversation

nurtai325 commented Oct 12, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ArkuNC Oct 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ArkuNC Oct 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

ArkuNC Oct 15, 2025 •

edited

Loading

ArkuNC Oct 15, 2025 •

edited

Loading