HTTPRoute not accepted if namespace selector is used #28186

tobiaskohlbau · 2023-09-16T15:34:32Z

Is there an existing issue for this?

I have searched the existing issues

What happened?

Having the following scenario within a Gateway API enabled cluster:

A Gateway with multiple listeners for different hostnames. One of the listeners needs to allow a HTTPRoute from another namespace. Enabling a namespace selector for one listener breaks every HTTPRoute attached to the gateway.

Gateway definition:

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: reproducer
spec:
  gatewayClassName: cilium
  listeners:
  - name: one
    protocol: HTTPS
    port: 443
    hostname: "one.example.org"
    tls:
      certificateRefs:
      - kind: Secret
        name: one-tls
  - name: two
    protocol: HTTPS
    port: 443
    hostname: "two.example.org"
    tls:
      certificateRefs:
      - kind: Secret
        name: two-tls
    allowedRoutes:
      namespaces:
        from: Selector
        selector:
          matchLabels:
            kubernetes.io/metadata.name: kube-system

HTTPRoute:

apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: one
spec:
  parentRefs:
  - name: reproducer
    sectionName: one
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: one
      port: 80

The HTTP route gets rejected as soon as the second listener is added. The Gateway API specification states the following about sectionName:

SectionName is the name of a section within the target resource. In the following resources, SectionName is interpreted as the following:

Gateway: Listener Name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values.

I read this as such setup of multiple restrictions within a gateway should be explicitly supported. Makes sense as otherwise bringing allowedRoutes into each listener is meaningless.

I would interpret this as an oversight during implementation. Especially cause the CheckGatewayMatchingSection already checks against sectionName. I would suggest CheckGatewayAllowedForNamespace should get the same check. I've changed a local copy of cilium with the required check to exclude listeners not matching the sectionName and everything is working as expected.

If the current behaviour gets confirmed as not intended I would like to submit a PR for this. The code is already done, but I want to confirm that this changes is welcomed.

Cilium Version

1.14.2

Kernel Version

Linux node 5.15.0-1037-raspi #40-Ubuntu SMP PREEMPT Fri Aug 25 16:42:00 UTC 2023 aarch64 aarch64 aarch64 GNU/Linux

Kubernetes Version

Client Version: v1.28.1
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.27.5+k3s1

Sysdump

No response

Relevant log output

HTTPRoute is not allowed to attach to this Gateway due to namespace selector restrictions

Anything else?

The current changes can be found here.

Code of Conduct

I agree to follow this project's Code of Conduct

The text was updated successfully, but these errors were encountered:

AnthonyPoschen · 2023-09-22T13:58:53Z

im also coming across this issue trying to use a shared gateway.
cilium: 1.14.2
kubernetes server: 1.28.2

---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: ingress
  namespace: kube-system
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod-cluster
spec:
  gatewayClassName: cilium
  listeners:
    - name: http-one
      protocol: HTTP
      port: 80
      hostname: "one.example.com"
      allowedRoutes:
        namespaces:
          from: Selector
          selector:
            matchLabels:
              toolkit.fluxcd.io/tenant: one
    - name: http-one-shorthand
      protocol: HTTP
      port: 80
      hostname: "o.example.com"
      allowedRoutes:
        namespaces:
          from: Selector
          selector:
            matchLabels:
              toolkit.fluxcd.io/tenant: one
    - name: http-two
      protocol: HTTP
      port: 80
      hostname: "two.com"
      allowedRoutes:
        namespaces:
          from: Selector
          selector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
    - name: https-two
      protocol: HTTPS
      port: 443
      hostname: "two.com"
      allowedRoutes:
        namespaces:
          from: Selector
          selector:
            matchLabels:
              toolkit.fluxcd.io/tenant: two
      tls:
        certificateRefs:
          - kind: Secret
            name: two-cert
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: http-redirect
  namespace: kube-system
spec:
  parentRefs:
    - name: ingress
      namespace: kube-system
      sectionName: http-two
  hostnames:
    - "two.com"
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301

i see the following on the http route

❯ kubectl get httproute -n kube-system -o yaml
apiVersion: v1
items:
- apiVersion: gateway.networking.k8s.io/v1beta1
  kind: HTTPRoute
  metadata:
    creationTimestamp: "2023-09-22T12:44:14Z"
    generation: 2
    labels:
      kustomize.toolkit.fluxcd.io/name: k8s
      kustomize.toolkit.fluxcd.io/namespace: flux-system
    name: http-redirect
    namespace: kube-system
    resourceVersion: "12240966"
    uid: aadd9cb7-4414-4c72-9388-5a42c0bfc0f4
  spec:
    hostnames:
    - two.com
    parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: ingress
      namespace: kube-system
      sectionName: http-two
    rules:
    - filters:
      - requestRedirect:
          scheme: https
          statusCode: 301
        type: RequestRedirect
      matches:
      - path:
          type: PathPrefix
          value: /
  status:
    parents:
    - conditions:
      - lastTransitionTime: "2023-09-22T12:46:00Z"
        message: HTTPRoute is not allowed to attach to this Gateway due to namespace
          selector restrictions
        observedGeneration: 2
        reason: NotAllowedByListeners
        status: "False"
        type: Accepted
      - lastTransitionTime: "2023-09-22T12:46:00Z"
        message: Service reference is valid
        observedGeneration: 2
        reason: ResolvedRefs
        status: "True"
        type: ResolvedRefs
      controllerName: io.cilium/gateway-controller
      parentRef:
        group: gateway.networking.k8s.io
        kind: Gateway
        name: ingress
        namespace: kube-system
        sectionName: http-amfencing
kind: List
metadata:
  resourceVersion: ""
  
  
❯ kubectl get ns kube-system -o yaml
apiVersion: v1
kind: Namespace
metadata:
  creationTimestamp: "2023-07-17T08:07:14Z"
  labels:
    kubernetes.io/metadata.name: kube-system
  name: kube-system
  resourceVersion: "40"
  uid: 9adbdfe9-e3ab-43a3-892f-a8b98f918f6a
spec:
  finalizers:
  - kubernetes
status:
  phase: Active

AnthonyPoschen · 2023-09-22T14:23:40Z

one thing to note as well when i switch the selector to "All"

The http redirect rule is also bound to the https listener and i get the https website redirecting in on itself constantly.

@tobiaskohlbau i think this patch should be a good resolution I haven't gone to the effort yet to patch locally but id say this is most likely a valid bug based on expected usage patterns of the gateway / httproute object's documentation, might be a good idea to raise a PR.

sayboras · 2023-09-25T14:51:16Z

thanks both for reporting this issue, temporarily assigned to myself so that I can triage this later.

aleksanderaleksic · 2023-09-29T06:53:22Z

Can confirm I have the same issue, adding my config as well if it is of any help.
With the config below I also get a redirect loop even if I use the https scheme.

---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: public
  namespace: gateway-system
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
spec:
  gatewayClassName: cilium
  listeners:
    - name: http
      port: 80
      protocol: HTTP
      allowedRoutes:
        namespaces:
          from: Same
    - hostname: "*.example.com" #Replaced by kustomize
      name: example-com-tls
      port: 443
      protocol: HTTPS
      allowedRoutes:
        namespaces:
          from: All
      tls:
        mode: Terminate
        certificateRefs:
          - name: letsencrypt-tls
            kind: Secret
            group: ""
            namespace: gateway-system
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: http-filter-redirect
  namespace: gateway-system
spec:
  parentRefs:
    - name: public
      sectionName: http
  hostnames:
    - "*.example.com"
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: books-app
  namespace: books
spec:
  hostnames:
  - books.example.com
  parentRefs:
    - name: public
      namespace: gateway-system
      kind: Gateway
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /details
      backendRefs:
        - name: details
          port: 9080
    - matches:
        - headers:
            - type: Exact
              name: magic
              value: foo
          queryParams:
            - type: Exact
              name: great
              value: example
          path:
            type: PathPrefix
            value: /
          method: GET
      backendRefs:
        - name: productpage
          port: 9080

sayboras · 2023-10-10T13:19:39Z

👋 Seems like the issue is fixed recently in main with the PR #27309.

I have tried to test with the below manifest, but unable to replicate the issue.

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: reproducer
spec:
  gatewayClassName: cilium
  listeners:
  - name: one
    protocol: HTTPS
    port: 443
    hostname: "one.example.org"
    tls:
      certificateRefs:
      - kind: Secret
        name: one-tls
# Un-comment and apply again later
#  - name: two
#    protocol: HTTPS
#    port: 443
#    hostname: "two.example.org"
#    tls:
#      certificateRefs:
#      - kind: Secret
#        name: two-tls
#    allowedRoutes:
#      namespaces:
#        from: Selector
#        selector:
#          matchLabels:
#            kubernetes.io/metadata.name: kube-system
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: one
spec:
  parentRefs:
  - name: reproducer
    sectionName: one
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: details
      port: 9080

$ kg httproute one -o json | jqs
{
  "parents": [
    {
      "conditions": [
        {
          "lastTransitionTime": "2023-10-10T12:30:37Z",
          "message": "Accepted HTTPRoute",
          "observedGeneration": 2,
          "reason": "Accepted",
          "status": "True",
          "type": "Accepted"
        },
        {
          "lastTransitionTime": "2023-10-10T12:30:37Z",
          "message": "Service reference is valid",
          "observedGeneration": 2,
          "reason": "ResolvedRefs",
          "status": "True",
          "type": "ResolvedRefs"
        }
      ],
      "controllerName": "io.cilium/gateway-controller",
      "parentRef": {
        "group": "gateway.networking.k8s.io",
        "kind": "Gateway",
        "name": "reproducer",
        "sectionName": "one"
      }
    }
  ]
}

AnthonyPoschen · 2023-10-10T14:28:46Z

im using 1.14.2 and see this issue which i believe that PR was introduced?
image: quay.io/cilium/cilium:v1.14.2@sha256:6263f3a3d5d63b267b538298dbeb5ae87da3efacf09a2c620446c873ba807d35

@sayboras heres another example slimmed down to reproduce. with the below configuration you always hit the redirect route regardless what listener you land on as the section filter isn't working when you start using multiple listeners on the same hostname

---
apiversion: gateway.networking.k8s.io/v1beta1
kind: gateway
metadata:
  name: ingress
  namespace: kube-system
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod-cluster
spec:
  gatewayclassname: cilium
  listeners:
    - name: http-example
      protocol: http
      port: 80
      hostname: "example.com"
      allowedroutes:
        namespaces:
          from: all
    - name: https-example
      protocol: https
      port: 443
      hostname: "example.com"
      allowedroutes:
        namespaces:
          from: all
      tls:
        certificaterefs:
          - kind: secret
            name: example-cert
---
apiversion: gateway.networking.k8s.io/v1beta1
kind: httproute
metadata:
  name: http-redirect
  namespace: kube-system
spec:
  parentrefs:
    - name: ingress
      namespace: kube-system
      sectionname: http-example
  hostnames:
    - "example.com"
  rules:
    - filters:
        - type: requestredirect
          requestredirect:
            scheme: https
            statuscode: 301
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: example-route
  namespace: example-app
spec:
  parentRefs:
    - name: ingress
      namespace: kube-system
      sectionName: https-example
  hostnames:
    - "example.com"
  rules:
    - backendRefs:
      - name: example
        port: 80
---
apiVersion: v1
kind: Service
metadata:
  name: example
  labels:
    app: example
spec:
  ports:
  - port: 80
    targetPort: 3000
    name: web
    protocol: TCP
  selector:
    app: example

sayboras · 2023-10-10T22:59:30Z

The redirect loop issue might not be related to the issue reported in the first post.

I am watching the upstream issue, so I would have expected there would be some change in the upstream API.

kubernetes-sigs/gateway-api#1185

sayboras · 2023-10-11T00:34:47Z

Thanks for your above manifest, let me give it a try.

AnthonyPoschen · 2023-10-14T05:32:14Z

The redirect loop issue might not be related to the issue reported in the first post.

I am watching the upstream issue, so I would have expected there would be some change in the upstream API.

kubernetes-sigs/gateway-api#1185

im not sure if what i reported is related to that issue as the Origional post mentioned this as a workaround

AFAIK to avoid this you'd need to create separate HTTPRoutes, one with the redirect and one without, and either bind them to separate Gateways or use a combination of allowedRoutes configuration and namespaced backendRefs to bind them to only one Listener on a single Gateway.

i believe my manifests above meet that condition of a HTTP route per listener to avoid a loop scenario so it wouldn't be related to that upstream issue which is more a feature request to modify behaviour when you intentionally loop back into the same listener.

youngnick · 2023-10-16T04:20:00Z

Thanks for the multiple manifests @AnthonyPoschen. It does look like we have a problem somewhere with the sectionName handling - in that last example, there should be no redirect loop because one HTTPRoute should be binding to the http-example Listener, and one to the https-example Listener.

@sayboras, this seems like it could probably use a conformance test upstream once we figure it out as well.

sayboras · 2023-10-31T08:14:06Z

I can reproduce this issue locally, working on how we can fix it now. Thanks a lot for your details.

This is to fix the issue in which the wrong list of HTTP routes is used to construct virtual host for insecure and secure routes. Ideally, only related HTTP routes for the same listener ports should be considered. Normally, this should not have any side effect, except using weightage clusters for the multiple, but the same, backends. However, in case of redirect filter, this will cause redirect loop as mentioned in the below issue. Fixes: cilium#28186 Signed-off-by: Tam Mach <tam.mach@cilium.io>

This is to fix the issue in which the wrong list of HTTP routes is used to construct virtual host for insecure and secure routes. Ideally, only related HTTP routes for the same listener ports should be considered. Normally, this should not have any side effect, except using weightage clusters for the multiple, but the same, backends. However, in case of redirect filter, this will cause redirect loop as mentioned in the below issue. Fixes: 299648f Fixes: cilium#28186 Signed-off-by: Tam Mach <tam.mach@cilium.io>

This is to fix the issue in which the wrong list of HTTP routes is used to construct virtual host for insecure and secure routes. Ideally, only related HTTP routes for the same listener ports should be considered. Normally, this should not have any side effect, except using weightage clusters for the multiple, but the same, backends. However, in case of redirect filter, this will cause redirect loop as mentioned in the below issue. Fixes: 299648f Fixes: #28186 Signed-off-by: Tam Mach <tam.mach@cilium.io>

This is to fix the issue in which the wrong list of HTTP routes is used to construct virtual host for insecure and secure routes. Ideally, only related HTTP routes for the same listener ports should be considered. Normally, this should not have any side effect, except using weightage clusters for the multiple, but the same, backends. However, in case of redirect filter, this will cause redirect loop as mentioned in the below issue. Fixes: 299648f Fixes: cilium#28186 Signed-off-by: Tam Mach <tam.mach@cilium.io>

rouke-broersma · 2023-11-27T09:37:45Z

@sayboras I am still getting this on 1.14.4 with this gateway config:

spec:
  gatewayClassName: cilium
  listeners:
  - name: web-http
    protocol: HTTP
    port: 80
    hostname: '*.example.com'
    allowedRoutes:	
      namespaces:	
        from: Same
  - name: web-https
    protocol: HTTPS
    port: 443
    hostname: '*.example.com'
    allowedRoutes:
      namespaces:
        from: All
    tls:
      mode: Terminate
      certificateRefs:
      - group: ''	
        kind: Secret	
        name: star-example-com-tls
  - name: ldaps
    protocol: TLS
    port: 636
    hostname: 'ldap.example.com'
    allowedRoutes:
      namespaces:
        from: Selector
        selector:
          matchLabels:
            use-private-gateway-ldaps: 'true'
    tls:
      mode: Terminate
      certificateRefs:
      - group: ''	
        kind: Secret	
        name: ldap-example-com-tls
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: tls-upgrade
spec:
  parentRefs:
  - name: private-gateway
    sectionName: web-http
  hostnames:
  - '*.example.com'
  rules:
  - filters:
    - type: RequestRedirect
      requestRedirect:
        scheme: https
        port: 443

Once I delete the listeners ldaps and web-https the tls-upgrade HTTPRoute deployed in the same namespace as the gateway is accepted. Once I delete web-http and web-https the ldaps listener accepts a TLSRoute from a namespace that has the label use-private-gateway-ldaps: 'true'. With all three listeners deployed all routes are denied.

Status of tls-upgrade:

status:	
  parents:	
    - conditions:	
        - lastTransitionTime: '2023-11-26T13:22:30Z'	
          message: >-	
            HTTPRoute is not allowed to attach to this Gateway due to namespace	
            selector restrictions	
          observedGeneration: 1	
          reason: NotAllowedByListeners	
          status: 'False'	
          type: Accepted	
        - lastTransitionTime: '2023-11-26T13:22:30Z'	
          message: Service reference is valid	
          observedGeneration: 1	
          reason: ResolvedRefs	
          status: 'True'	
          type: ResolvedRefs	
      controllerName: io.cilium/gateway-controller	
      parentRef:	
        group: gateway.networking.k8s.io	
        kind: Gateway	
        name: private-gateway	
        sectionName: web-http

tobiaskohlbau · 2023-11-27T09:57:39Z

Unfortunately I'm unable to validate the fix myself as this was only for a homelab and I moved to a simpler setup. Maybe I will find time to recreate the setup.

youngnick · 2023-11-28T00:16:04Z

@rouke-broersma I don't think this fix is included in 1.14.4, it has not been backported yet. So it will be included in main, if you can test there, or it should be included in 1.14.5 when that is released (@sayboras has already marked the PR for backport).

rouke-broersma · 2023-11-28T08:47:18Z

@youngnick there are two issues and two mentioned PRs for this issue.

#27309 is the issue I'm having, and I think that was included in 1.14.2 so should be fixed, but I'm still hitting it in 1.14.4.

The other issue #29115 is not yet backported but I'm not hitting that issue.

This is to fix the issue in which the wrong list of HTTP routes is used to construct virtual host for insecure and secure routes. Ideally, only related HTTP routes for the same listener ports should be considered. Normally, this should not have any side effect, except using weightage clusters for the multiple, but the same, backends. However, in case of redirect filter, this will cause redirect loop as mentioned in the below issue. Fixes: 299648f Fixes: #28186 Signed-off-by: Tam Mach <tam.mach@cilium.io>

youngnick · 2023-11-29T00:13:41Z

Thanks for that explanation @rouke-broersma. @sayboras, did you want to take another look here?

sayboras · 2023-11-29T00:17:05Z

Somehow this didn't come up in my GitHub notification, re-open the issue now.

This is to fix the issue in which the wrong list of HTTP routes is used to construct virtual host for insecure and secure routes. Ideally, only related HTTP routes for the same listener ports should be considered. Normally, this should not have any side effect, except using weightage clusters for the multiple, but the same, backends. However, in case of redirect filter, this will cause redirect loop as mentioned in the below issue. Fixes: 299648f Fixes: #28186 Signed-off-by: Tam Mach <tam.mach@cilium.io>

This is to fix the issue in which the wrong list of HTTP routes is used to construct virtual host for insecure and secure routes. Ideally, only related HTTP routes for the same listener ports should be considered. Normally, this should not have any side effect, except using weightage clusters for the multiple, but the same, backends. However, in case of redirect filter, this will cause redirect loop as mentioned in the below issue. Fixes: 299648f Fixes: cilium#28186 Signed-off-by: Tam Mach <tam.mach@cilium.io>

skillcoder · 2024-01-08T23:35:18Z

Face same problem on 1.15.0-rc.0
I have 2 listeners for different hostnames in different namespaces
This works:

    allowedRoutes:
      kinds:
      - kind: HTTPRoute
      namespaces:
        from: All

And this not:

    allowedRoutes:
      kinds:
      - kind: HTTPRoute
      namespaces:
        from: Selector
        selector:
          matchLabels:
            kubernetes.io/metadata.name: argocd

sayboras · 2024-01-29T01:41:35Z

This should be fixed as part of #30100, which will be backported to 1.15 and 1.14 later.

tobiaskohlbau added kind/bug This is a bug in the Cilium logic. kind/community-report This was reported by a user in the Cilium community, eg via Slack. needs/triage This issue requires triaging to establish severity and next steps. labels Sep 16, 2023

sayboras self-assigned this Sep 25, 2023

aanm added sig/agent Cilium agent related. area/servicemesh GH issues or PRs regarding servicemesh labels Oct 9, 2023

sayboras mentioned this issue Nov 12, 2023

gateway-api: Avoid redirect loop when the same host name is used for http and https listeners #29115

Merged

julianwiedmann closed this as completed in #29115 Nov 13, 2023

sayboras reopened this Nov 29, 2023

sayboras closed this as completed Jan 29, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

HTTPRoute not accepted if namespace selector is used #28186

HTTPRoute not accepted if namespace selector is used #28186

tobiaskohlbau commented Sep 16, 2023 •

edited

AnthonyPoschen commented Sep 22, 2023 •

edited

AnthonyPoschen commented Sep 22, 2023 •

edited

sayboras commented Sep 25, 2023

aleksanderaleksic commented Sep 29, 2023

sayboras commented Oct 10, 2023

AnthonyPoschen commented Oct 10, 2023

sayboras commented Oct 10, 2023

sayboras commented Oct 11, 2023

AnthonyPoschen commented Oct 14, 2023

youngnick commented Oct 16, 2023

sayboras commented Oct 31, 2023

rouke-broersma commented Nov 27, 2023

tobiaskohlbau commented Nov 27, 2023

youngnick commented Nov 28, 2023

rouke-broersma commented Nov 28, 2023

youngnick commented Nov 29, 2023

sayboras commented Nov 29, 2023

skillcoder commented Jan 8, 2024

sayboras commented Jan 29, 2024

HTTPRoute not accepted if namespace selector is used #28186

HTTPRoute not accepted if namespace selector is used #28186

Comments

tobiaskohlbau commented Sep 16, 2023 • edited

Is there an existing issue for this?

What happened?

Cilium Version

Kernel Version

Kubernetes Version

Sysdump

Relevant log output

Anything else?

Code of Conduct

AnthonyPoschen commented Sep 22, 2023 • edited

AnthonyPoschen commented Sep 22, 2023 • edited

sayboras commented Sep 25, 2023

aleksanderaleksic commented Sep 29, 2023

sayboras commented Oct 10, 2023

AnthonyPoschen commented Oct 10, 2023

sayboras commented Oct 10, 2023

sayboras commented Oct 11, 2023

AnthonyPoschen commented Oct 14, 2023

youngnick commented Oct 16, 2023

sayboras commented Oct 31, 2023

rouke-broersma commented Nov 27, 2023

tobiaskohlbau commented Nov 27, 2023

youngnick commented Nov 28, 2023

rouke-broersma commented Nov 28, 2023

youngnick commented Nov 29, 2023

sayboras commented Nov 29, 2023

skillcoder commented Jan 8, 2024

sayboras commented Jan 29, 2024

tobiaskohlbau commented Sep 16, 2023 •

edited

AnthonyPoschen commented Sep 22, 2023 •

edited

AnthonyPoschen commented Sep 22, 2023 •

edited