KEP-3104 Feature Blog entry #52987

pmengelbert · 2025-10-28T12:25:01Z

Description

Issue

Closes: #

Signed-off-by: Peter Engelbert <[email protected]>

netlify · 2025-10-28T12:25:08Z

👷 Deploy Preview for kubernetes-io-vnext-staging processing.

Name	Link
🔨 Latest commit	`9050ec0`
🔍 Latest deploy log	https://app.netlify.com/projects/kubernetes-io-vnext-staging/deploys/6900b62167534c0008530da9

netlify · 2025-10-28T12:34:09Z

✅ Pull request preview available for checking

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`7aad6a2`
🔍 Latest deploy log	https://app.netlify.com/projects/kubernetes-io-main-staging/deploys/6925cb1c906f4d0008014b83
😎 Deploy Preview	https://deploy-preview-52987--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

graz-dev · 2025-10-29T10:08:02Z

Hi @pmengelbert thank you for opening this feture blog placeholder PR.
Feature Blog PRs should be opened against the main brach could you please fix it?

I also see 81 changed files, is it correct?

EDIT: can you also confirm that this is the feature blog placeholder PR for kubernetes/enhancements#3104?

pmengelbert · 2025-10-29T15:12:16Z

Hi @pmengelbert thank you for opening this feture blog placeholder PR. Feature Blog PRs should be opened against the main brach could you please fix it?

fixed

I also see 81 changed files, is it correct?

that was because the branch was synced with main but the PR base was dev-1.35. Now that the PR base is main, that's fixed.

EDIT: can you also confirm that this is the feature blog placeholder PR for kubernetes/enhancements#3104?

Specifically, it's for the addition of the credential plugin allowlist, which was recently added to KEP 3104 via an update.

graz-dev · 2025-10-29T16:16:47Z

Nice, thank you @pmengelbert !

graz-dev · 2025-11-17T09:14:59Z

Hi @pmengelbert 👋 v1.35 Communications team here,

@helayoty as author of #52897, I'd like you to be a writing buddy for @pmengelbert on this PR.

Please:

Review this PR, paying attention to the guidelines and review hints
Update your own PR based on any best practices you identify that should be applied
Remember to be compassionate with your fellow article author

pmengelbert · 2025-11-17T15:48:22Z

@graz-dev, it looks as though two numbers have been transposed in the issues. My issue is 52987, and @helayoty 's issue is 52897 -- they contain the same numbers but in different orders.

…

On Mon, Nov 17, 2025 at 4:15 AM Graziano Casto ***@***.***> wrote: *graz-dev* left a comment (kubernetes/website#52987) <#52987 (comment)> Hi @pmengelbert <https://github.com/pmengelbert> 👋 v1.35 Communications team here, @helayoty <https://github.com/helayoty> as author of #52897 <#52897>, I'd like you to be a writing buddy <https://kubernetes.io/docs/contribute/blog/writing-buddy/> for @XX <https://github.com/XX> on this PR. Please: - Review this PR, paying attention to the guidelines <https://kubernetes.io/docs/contribute/blog/guidelines/> and review hints <https://kubernetes.io/docs/contribute/blog/writing-buddy/#pull-request-review> - Update your own PR based on any best practices you identify that should be applied - Remember to be compassionate with your fellow article author — Reply to this email directly, view it on GitHub <#52987 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AIXSO56BOFQ2DCGMYQ2UL3T35GG2VAVCNFSM6AAAAACKN2HLUKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTKNBQG4YTQNRWGU> . You are receiving this because you were mentioned.Message ID: ***@***.***>

Signed-off-by: Peter Engelbert <[email protected]>

graz-dev · 2025-11-18T21:33:42Z

Hi @pmengelbert the meaning of my message is heaving @helayoty as a buddy for you to review the content of this PR since it is the author of another feature blog (#52897).
Same for you on her PR :)

graz-dev · 2025-11-18T21:47:00Z

Hi @pmengelbert 👋 -- this is Graziano (@graz-dev) from the v1.35 Communications Team!

Just a friendly reminder that we are approaching the feature blog "ready for review" deadline: Friday 21st November. We ask you to have the blog PR in non-draft state, and all write-up to be complete, so that we can start the blog review from SIG Docs Blog team.

If you have any questions or need help, please don't hesitate to reach out to me or any of the Communications Team members. We are here to help you!

helayoty · 2025-11-19T00:32:02Z

/assign @helayoty

helayoty

Added some comments.

helayoty · 2025-11-19T00:58:50Z

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

@@ -0,0 +1,105 @@
+---
+layout: blog
+title: "Kubernetes v1.35: Protect your Machine from Untrusted Executables with the Credential Plugin Policy and Allowlist"


I'd recommend shorten the blog title.

helayoty · 2025-11-19T01:04:37Z

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

+To give the user more control over what gets run on their system, kubernetes
+1.35 adds the credential plugin policy and allowlist. This is available to all


What clients? Why does kuberc have more impact? This needs clarification or the statement should be reconsidered

What state is this feature at? (alpha, beta, GA)

Does user need to enable any feature gate/config? If yes, we need to mention it.

Agree, only kubectl reads and knows kuberc, if there are other consumers, we don't quite care about that. So let's explicitly say kubectl here.

helayoty · 2025-11-19T01:08:43Z

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

+---
+
+Did you know that `kubectl` can run arbitrary executables -- including shell
+scripts -- with the full priveleges of the invoking user, and without your


nit: priveleges-> privileges

helayoty · 2025-11-19T01:09:19Z

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

+you probably see the problem: do you know what your `kubeconfig` is running on
+your machine? Do you trust the pipeline that generated your `kubeconfig`?
+
+To give the user more control over what gets run on their system, kubernetes


nit: kubernetes -> Kubernetes

This statement is confusing, I'd probably say that SIG-Auth and SIG-CLI decided to add to Kubernetes 1.35.

helayoty · 2025-11-19T01:12:16Z

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

+you probably see the problem: do you know what your `kubeconfig` is running on
+your machine? Do you trust the pipeline that generated your `kubeconfig`?


I'd add few scenarios for the actual threats. (supply chain attacks, compromised pipelines, etc... )

It would be nice, I agree.

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

helayoty · 2025-11-19T01:15:47Z

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

+If you *don't know* whether or not you're using exec credential plugins, try
+setting your policy to `DenyAll`:


Is there any config user need to consider for the rollout?

I'd rather ask, how user can verify what breaks when they try to use it. Eg. if you run into issues try running kubectl get pods with increased logging --verbosity=5 or whatever log-level will provide sufficient information for the user to identify problems. Bonus points if you can point explicit log lines that will suggest what's failing and why.

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

helayoty · 2025-11-19T01:21:37Z

of

Ah got it. Done :)

helayoty · 2025-11-19T01:23:03Z

@graz-dev What is the right format to add blog file? Create a folder under /blog or just create md file? What is the difference?

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

soltysh · 2025-11-19T13:12:54Z

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

+you probably see the problem: do you know what your `kubeconfig` is running on
+your machine? Do you trust the pipeline that generated your `kubeconfig`?


It would be nice, I agree.

soltysh · 2025-11-19T13:14:19Z

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

+you probably see the problem: do you know what your `kubeconfig` is running on
+your machine? Do you trust the pipeline that generated your `kubeconfig`?
+
+To give the user more control over what gets run on their system, kubernetes


This statement is confusing, I'd probably say that SIG-Auth and SIG-CLI decided to add to Kubernetes 1.35.

soltysh · 2025-11-19T13:14:58Z

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

+To give the user more control over what gets run on their system, kubernetes
+1.35 adds the credential plugin policy and allowlist. This is available to all


Agree, only kubectl reads and knows kuberc, if there are other consumers, we don't quite care about that. So let's explicitly say kubectl here.

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

soltysh · 2025-11-19T13:18:17Z

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

+If you *don't know* whether or not you're using exec credential plugins, try
+setting your policy to `DenyAll`:


I'd rather ask, how user can verify what breaks when they try to use it. Eg. if you run into issues try running kubectl get pods with increased logging --verbosity=5 or whatever log-level will provide sufficient information for the user to identify problems. Bonus points if you can point explicit log lines that will suggest what's failing and why.

soltysh · 2025-11-19T13:18:46Z

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

+If you *are* using credential plugins, you'll quickly find out what `kubectl` is
+trying to execute. You'll get an error like the following.
+
+> Unable to connect to the server: getting credentials: plugin "cloudco-login" not allowed: policy set to "DenyAll"


This should be move to previous paragraph where you covered DenyAll.

soltysh · 2025-11-19T13:20:08Z

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

+`exec.LookPath`. Both forms (basename and full path) are acceptable, but the
+full path is preferable because it narrows the scope of allowed binaries even
+further.
+


Probably worth explaining if glob-ing is allowed, and the different between AND-ed and OR-ed names, as described in #52877 where I asked for explicit examples.

soltysh · 2025-11-19T13:21:48Z

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

+
+## Get involved
+
+The credential plugin policy and allowlist has reached beta, and we are very interested


This is misleading, let's be explicit that kuberc is beta, Plugin Policy is just part of the extensions happening while we're at beta. I don't want to give false impressions and confuse our users.

Was not trying to intentionally mislead, it's an artifact of using the prior kuberc blog post as scaffolding. I'll fix this.

This issue is not resolved yet. The blog should be explicit about this distinction to avoid confusing users.

pmengelbert · 2025-11-19T15:58:06Z

Hi @pmengelbert the meaning of my message is heaving @helayoty as a buddy for you to review the content of this PR since it is the author of another feature blog (#52897). Same for you on her PR :)

My mistake! Thanks for the clarification. This is my first time through the process :)

graz-dev · 2025-11-20T21:34:47Z

@graz-dev What is the right format to add blog file? Create a folder under /blog or just create md file? What is the difference?

@helayoty if you need to add some images into the blog post the folder is the best option, if not you can go with a single md file in the blog folder

Co-authored-by: Maciej Szulik <[email protected]>

* Add note explaining that globbing does not work * Add examples of threats * Capitalize Kubernetes * Clean up second paragraph * * Clean up language * * Describe how it's available to users of `client-go` * * Clarify no feature gates are needed * * Clarify this is a beta feature Signed-off-by: Peter Engelbert <[email protected]>

windsonsea · 2025-11-26T01:15:51Z

/remove-language fr it ko pt zh
/remove-area localization

pmengelbert · 2025-12-01T20:22:17Z

/assign @benjaminapetersen

helayoty

one nit comment.

helayoty · 2025-12-02T00:18:13Z

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

+
+## Get involved
+
+The credential plugin policy and allowlist has reached beta, and we are very interested


This issue is not resolved yet. The blog should be explicit about this distinction to avoid confusing users.

soltysh · 2025-12-01T16:40:43Z

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

+To give the user more control over what gets run on their system, Sig-Auth and
+Sig-CLI added the credential plugin policy and allowlist as a beta feature to


Suggested change

To give the user more control over what gets run on their system, Sig-Auth and

Sig-CLI added the credential plugin policy and allowlist as a beta feature to

To give the user more control over what gets run on their system, [SIG-Auth](https://git.k8s.io/community/sig-auth) and

[SIG-CLI](https://git.k8s.io/community/sig-cli) added the credential plugin policy and allowlist as a beta feature to

Even better: SIG Auth and SIG CLI (with a space); that's what our style guide recommends.

soltysh · 2025-12-03T13:19:08Z

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

+credentialPluginPolicy: DenyAll
+```
+
+### Selectively Allowing Plugins


Since the below paragraph nicely flows into the debugging DenyAll, I'd probably move this paragraph start after the next paragraph. Specifically, after the example log message. So that you'll have:

### Selectively Allowing Plugins What if you need the `cloudco-login` plugin...

(nit) We prefer to write headings in sentence case.

soltysh · 2025-12-03T13:21:40Z

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

+
+## Get involved
+
+The credential plugin policy and allowlist has reached beta, and we are very interested


Maybe reword it to something like:

Suggested change

The credential plugin policy and allowlist has reached beta, and we are very interested

The credential plugin policy is still under development, and we are very interested

this will drop the unnecessary confusion, and leave the necessary room for input. We have docs which explain the exact state of the feature, and we also mentioned that earlier in this document. So let's keep it simple 😄

soltysh · 2025-12-03T13:30:01Z

/label tide/merge-method-squash

lmktfy · 2025-12-10T21:13:44Z

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

+
+## How it works
+
+A full description of this functionality is available [in our official documentation](/docs/reference/kubectl/kuberc/),


Suggested change

A full description of this functionality is available [in our official documentation](/docs/reference/kubectl/kuberc/),

A full description of this functionality is available in our [official documentation](/docs/reference/kubectl/kuberc/) for kuberc,

lmktfy · 2025-12-10T21:15:13Z

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

+kind: Preference
+credentialPluginPolicy: DenyAll
+```
+


Suggested change

If you have more than one kubeconfig client context, it's a good

idea to check each of them before you continue.

lmktfy · 2025-12-10T21:15:48Z

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

+credentialPluginPolicy: DenyAll
+```
+
+### Selectively Allowing Plugins


(nit) We prefer to write headings in sentence case.

lmktfy · 2025-12-10T21:16:13Z

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

+(basename and full path) are acceptable, but the full path is preferable because
+it narrows the scope of allowed binaries even further.
+
+### Future Enhancements


Suggested change

### Future Enhancements

### Future enhancements

lmktfy · 2025-12-10T21:17:27Z

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

+
+### Future Enhancements
+
+Currently, an allowlist entry has only one field, `name`. In the future, we want


Suggested change

Currently, an allowlist entry has only one field, `name`. In the future, we want

Currently, an allowlist entry has only one field, `name`. In the future, we (Kubernetes SIG CLI) want

(avoid some people inferring that "we" means Microsoft)

lmktfy · 2025-12-10T21:19:00Z

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

+you'd like to see it solve. Or, if you have the cycles to contribute one of the
+above enhancements, they'd be a great way to get started contributing to
+Kubernetes. Feel free to join in the discussion on slack:
+- [SIG-CLI](https://kubernetes.slack.com/archives/C2GL57FJ4),


Suggested change

- [SIG-CLI](https://kubernetes.slack.com/archives/C2GL57FJ4),

- [#sig-cli](https://kubernetes.slack.com/archives/C2GL57FJ4),

lmktfy · 2025-12-10T21:19:45Z

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

+above enhancements, they'd be a great way to get started contributing to
+Kubernetes. Feel free to join in the discussion on slack:
+- [SIG-CLI](https://kubernetes.slack.com/archives/C2GL57FJ4),
+- [SIG-Auth](https://kubernetes.slack.com/archives/C0EN96KUY).


Suggested change

- [SIG-Auth](https://kubernetes.slack.com/archives/C0EN96KUY).

- [#sig-auth](https://kubernetes.slack.com/archives/C0EN96KUY).

lmktfy · 2025-12-10T21:22:15Z

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

+To give the user more control over what gets run on their system, Sig-Auth and
+Sig-CLI added the credential plugin policy and allowlist as a beta feature to
+Kubernetes 1.35. This is available to all clients using the `client-go` library,
+by filling out the `ExecProvider.PluginPolicy` struct on a REST config. To


This isn't especially linked to REST in the sense I'd recognize. Can we reword?

Since this particular element is discussing client-go API bits, maybe strictly pointing to
ExecProvider.PluginPolicy type: https://github.com/kubernetes/client-go/blob/master/tools/clientcmd/api/types.go#L290 would help clarifying this?

lmktfy · 2025-12-10T21:25:00Z

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

+Sig-CLI added the credential plugin policy and allowlist as a beta feature to
+Kubernetes 1.35. This is available to all clients using the `client-go` library,
+by filling out the `ExecProvider.PluginPolicy` struct on a REST config. To
+broaden the impact of this change, we made it easy to configure `kubectl` to use


Suggested change

broaden the impact of this change, we made it easy to configure `kubectl` to use

broaden the impact of this change, Kubernetes v1.35 also lets you manage this without

writing a line of application code. You can configure `kubectl` to enforce

?

lmktfy · 2025-12-10T21:27:29Z

content/en/blog/_posts/2025-11-17-kuberc-plugin-allowlist.md

@@ -0,0 +1,114 @@
+---
+layout: blog
+title: "Kubernetes v1.35: Protect your Machine from Untrusted Executables with the Credential Plugin Policy"


This could be snappier; what do you think of:

Suggested change

title: "Kubernetes v1.35: Protect your Machine from Untrusted Executables with the Credential Plugin Policy"

title: "Kubernetes v1.35: Protection Against Trojan Horse Kubeconfig Files"

I personally prefer the original.

Is there a different version where people who only read the title can easily figure out what they are skipping?

Not sure I understand what you're asking for, but I believe the original title answers the question what, maybe we can expand on the where part. As in, adding "in kuberc", although that makes it too long and somewhat clumsy.

graz-dev · 2025-12-12T16:02:49Z

Hi @pmengelbert, can you please implement the pending suggestions?
I'll be happy to merge it as a draft then.

Thank you.

Placeholder for KEP-3104 Feature Blog entry

9050ec0

Signed-off-by: Peter Engelbert <[email protected]>

k8s-ci-robot added this to the 1.35 milestone Oct 28, 2025

k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 28, 2025

k8s-ci-robot added area/blog Issues or PRs related to the Kubernetes Blog subproject area/localization General issues or PRs related to localization labels Oct 28, 2025

k8s-ci-robot requested a review from fabriziopandini October 28, 2025 12:25

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Oct 28, 2025

k8s-ci-robot requested a review from graz-dev October 28, 2025 12:25

graz-dev mentioned this pull request Oct 29, 2025

Separate kubectl user preferences from cluster configs kubernetes/enhancements#3104

Open

12 tasks

pmengelbert changed the base branch from dev-1.35 to main October 29, 2025 15:10

k8s-ci-robot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. and removed size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Oct 29, 2025

graz-dev mentioned this pull request Nov 17, 2025

KEP-5471: [Feature blog]Add Blog Post for Extended Toleration Operators Alpha in 1.35 #52897

Merged

Add credential plugin policy/allowlist blog post

78dcb8e

Signed-off-by: Peter Engelbert <[email protected]>

k8s-ci-robot removed the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Nov 17, 2025

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 17, 2025

k8s-ci-robot assigned helayoty Nov 19, 2025

helayoty suggested changes Nov 19, 2025

View reviewed changes

soltysh reviewed Nov 19, 2025

View reviewed changes

pmengelbert changed the title ~~Placeholder for KEP-3104 Feature Blog entry~~ KEP-3104 Feature Blog entry Nov 19, 2025

pmengelbert and others added 2 commits November 24, 2025 14:00

Apply suggestions from code review

497772f

Co-authored-by: Maciej Szulik <[email protected]>

k8s-ci-robot assigned benjaminapetersen Dec 1, 2025

helayoty reviewed Dec 2, 2025

View reviewed changes

soltysh reviewed Dec 3, 2025

View reviewed changes

k8s-ci-robot added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Dec 3, 2025

soltysh mentioned this pull request Dec 9, 2025

Kubernetes v1.35 Announcement Blog Post #53498

Open

lmktfy reviewed Dec 10, 2025

View reviewed changes

		To give the user more control over what gets run on their system, kubernetes
		1.35 adds the credential plugin policy and allowlist. This is available to all

		you probably see the problem: do you know what your `kubeconfig` is running on
		your machine? Do you trust the pipeline that generated your `kubeconfig`?

		If you don't know whether or not you're using exec credential plugins, try
		setting your policy to `DenyAll`:


		## Get involved

		The credential plugin policy and allowlist has reached beta, and we are very interested

		To give the user more control over what gets run on their system, Sig-Auth and
		Sig-CLI added the credential plugin policy and allowlist as a beta feature to

	The credential plugin policy and allowlist has reached beta, and we are very interested
	The credential plugin policy is still under development, and we are very interested


		## How it works

		A full description of this functionality is available [in our official documentation](/docs/reference/kubectl/kuberc/),



	If you have more than one kubeconfig client context, it's a good
	idea to check each of them before you continue.


		### Future Enhancements

		Currently, an allowlist entry has only one field, `name`. In the future, we want

	- [SIG-CLI](https://kubernetes.slack.com/archives/C2GL57FJ4),
	- [#sig-cli](https://kubernetes.slack.com/archives/C2GL57FJ4),

	- [SIG-Auth](https://kubernetes.slack.com/archives/C0EN96KUY).
	- [#sig-auth](https://kubernetes.slack.com/archives/C0EN96KUY).

	broaden the impact of this change, we made it easy to configure `kubectl` to use
	broaden the impact of this change, Kubernetes v1.35 also lets you manage this without
	writing a line of application code. You can configure `kubectl` to enforce

	title: "Kubernetes v1.35: Protect your Machine from Untrusted Executables with the Credential Plugin Policy"
	title: "Kubernetes v1.35: Protection Against Trojan Horse Kubeconfig Files"

KEP-3104 Feature Blog entry #52987

Are you sure you want to change the base?

KEP-3104 Feature Blog entry #52987

Conversation

pmengelbert commented Oct 28, 2025

Description

Issue

Uh oh!

netlify bot commented Oct 28, 2025

👷 Deploy Preview for kubernetes-io-vnext-staging processing.

Uh oh!

netlify bot commented Oct 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Pull request preview available for checking

Uh oh!

graz-dev commented Oct 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pmengelbert commented Oct 29, 2025

Uh oh!

graz-dev commented Oct 29, 2025

Uh oh!

graz-dev commented Nov 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pmengelbert commented Nov 17, 2025 via email

Uh oh!

graz-dev commented Nov 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

graz-dev commented Nov 18, 2025

Uh oh!

helayoty commented Nov 19, 2025

Uh oh!

helayoty left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

helayoty commented Nov 19, 2025

Uh oh!

helayoty commented Nov 19, 2025

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

netlify bot commented Oct 28, 2025 •

edited

Loading

graz-dev commented Oct 29, 2025 •

edited

Loading

graz-dev commented Nov 17, 2025 •

edited

Loading

graz-dev commented Nov 18, 2025 •

edited

Loading

lmktfy Dec 10, 2025 •

edited

Loading