@underpostnet/cyberia 3.3.0 → 3.3.76

package/manifests/deployment/mongo-express/deployment.yaml

@@ -4,6 +4,7 @@ metadata:
   name: mongo-express
   labels:
     app: mongo-express
+    group: db
 spec:
   replicas: 1
   selector:
@@ -13,25 +14,27 @@ spec:
     metadata:
       labels:
         app: mongo-express
+        group: db
     spec:
       containers:
         - name: mongo-express
-          image: mongo-express
+          image: mongo-express:1.0.2
           ports:
             - containerPort: 8081
           env:
-            # - name: ME_CONFIG_MONGODB_ADMINUSERNAME
-            #   valueFrom:
-            #     secretKeyRef:
-            #       name: mongodb-secret
-            #       key: username
-            # - name: ME_CONFIG_MONGODB_ADMINPASSWORD
-            #   valueFrom:
-            #     secretKeyRef:
-            #       name: mongodb-secret
-            #       key: password
-            - name: ME_CONFIG_SITE_BASEURL
-              value: '/mongo/'
+            # Both credential pairs come from the one `mongodb-secret` the StatefulSet already
+            # consumes: the UI authenticates to mongod with the root credentials, and gates its
+            # own session behind the same pair rather than the image's admin/pass defaults.
+            - name: ME_CONFIG_MONGODB_ADMINUSERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: mongodb-secret
+                  key: username
+            - name: ME_CONFIG_MONGODB_ADMINPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: mongodb-secret
+                  key: password
             - name: ME_CONFIG_BASICAUTH_USERNAME
               valueFrom:
                 secretKeyRef:
@@ -42,21 +45,37 @@ spec:
                 secretKeyRef:
                   name: mongodb-secret
                   key: password
+            - name: ME_CONFIG_SITE_BASEURL
+              value: '/mongo/'
+            # In-cluster identity of the first replica, identical under Kind, Kubeadm and K3s.
+            # The driver reads the replica set config from it and reaches the remaining members
+            # through the same headless service.
             - name: ME_CONFIG_MONGODB_SERVER
               value: 'mongodb-0.mongodb-service'
-            # - name: ME_CONFIG_MONGODB_ENABLE_ADMIN
-            #   value: 'true'
             - name: ME_CONFIG_MONGODB_PORT
               value: '27017'
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: mongo-express-service
-spec:
-  selector:
-    app: mongo-express
-  ports:
-    - protocol: TCP
-      port: 8081
-      targetPort: 8081
+            - name: ME_CONFIG_MONGODB_AUTH_DATABASE
+              value: 'admin'
+            # Without this the UI only lists the databases named in its config; the point of the
+            # deployment is browsing whatever collections the StatefulSet actually holds.
+            - name: ME_CONFIG_MONGODB_ENABLE_ADMIN
+              value: 'true'
+          readinessProbe:
+            tcpSocket:
+              port: 8081
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 5
+          livenessProbe:
+            tcpSocket:
+              port: 8081
+            initialDelaySeconds: 30
+            periodSeconds: 20
+            timeoutSeconds: 5
+          resources:
+            requests:
+              cpu: '50m'
+              memory: '128Mi'
+            limits:
+              cpu: '500m'
+              memory: '256Mi'

package/manifests/deployment/mongo-express/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+# kubectl apply -k manifests/deployment/mongo-express/.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # mongo-express-nodeport.yaml is intentionally absent: host/public exposure of an admin UI is
+  # opt-in, applied by `cluster --mongo-express --node-port` once the pod reports Ready.
+  - deployment.yaml
+  - service.yaml

package/manifests/deployment/mongo-express/mongo-express-nodeport.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: mongo-express-nodeport
+  labels:
+    app: mongo-express
+    group: db
+spec:
+  type: NodePort
+  externalTrafficPolicy: Cluster
+  selector:
+    app: mongo-express
+  ports:
+    - name: mongo-express
+      protocol: TCP
+      port: 8081
+      targetPort: 8081
+      nodePort: 32081

package/manifests/deployment/mongo-express/service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: mongo-express-service
+  labels:
+    app: mongo-express
+    group: db
+spec:
+  type: ClusterIP
+  selector:
+    app: mongo-express
+  ports:
+    - name: mongo-express
+      protocol: TCP
+      port: 8081
+      targetPort: 8081

package/manifests/deployment/mongo-express-no-auth/disable-mongodb-auth.yaml

@@ -0,0 +1,16 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mongo-express
+spec:
+  template:
+    spec:
+      containers:
+        - name: mongo-express
+          env:
+            - name: ME_CONFIG_MONGODB_ADMINUSERNAME
+              $patch: delete
+            - name: ME_CONFIG_MONGODB_ADMINPASSWORD
+              $patch: delete
+            - name: ME_CONFIG_MONGODB_AUTH_DATABASE
+              $patch: delete

package/manifests/deployment/mongo-express-no-auth/kustomization.yaml

@@ -0,0 +1,16 @@
+---
+# kubectl apply -k manifests/deployment/mongo-express-no-auth/.
+# Overlay of manifests/deployment/mongo-express for a mongod started without --auth
+# (manifests/mongodb-4.4). Credentials sent to a server that enforces none are not ignored: the
+# driver still runs SCRAM and the handshake fails, so the admin pair is dropped rather than left
+# resolving against a secret the server never checks. `cluster --mongo-express` selects between
+# this overlay and the base from the deployed StatefulSet's own mongod arguments.
+#
+# A sibling of the base rather than a child of it: kustomize rejects an overlay nested inside the
+# root it extends as a cycle.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../mongo-express
+patches:
+  - path: disable-mongodb-auth.yaml

package/manifests/grafana/deployment.yaml

@@ -6,6 +6,9 @@ metadata:
     app: grafana
   name: grafana
 spec:
+  # Never run two Grafana processes against the same local data directory.
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: grafana
@@ -21,13 +24,11 @@ spec:
       containers:
         - name: grafana
           image: grafana/grafana:latest
-          env:
-            # - name: GF_SERVER_ROOT_URL
-            #   value: '{{GF_SERVER_ROOT_URL}}'
-            - name: GF_SERVER_ROOT_URL
-              value: '/grafana'
-            - name: GF_SERVER_SERVE_FROM_SUB_PATH
-              value: 'true'
+          # GF_SERVER_ROOT_URL and GF_SERVER_SERVE_FROM_SUB_PATH are deliberately
+          # absent: Grafana builds every asset link and redirect from them, so
+          # their value depends on how it is published. `monitor --observability`
+          # sets both from the resolved exposure, which is the one place that
+          # knows.
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 3000
@@ -58,7 +59,25 @@ spec:
           volumeMounts:
             - mountPath: /var/lib/grafana
               name: grafana-pv
+            - mountPath: /etc/grafana/provisioning/datasources
+              name: grafana-datasources
+              readOnly: true
+            - mountPath: /etc/grafana/provisioning/dashboards
+              name: grafana-dashboard-provider
+              readOnly: true
+            - mountPath: /var/lib/grafana/dashboards
+              name: grafana-dashboards
+              readOnly: true
       volumes:
         - name: grafana-pv
           persistentVolumeClaim:
             claimName: grafana-pvc
+        - name: grafana-datasources
+          configMap:
+            name: grafana-datasources
+        - name: grafana-dashboard-provider
+          configMap:
+            name: grafana-dashboard-provider
+        - name: grafana-dashboards
+          configMap:
+            name: grafana-dashboards

package/manifests/grafana/kustomization.yaml

@@ -5,3 +5,4 @@ resources:
   - storage-class.yaml
   - pvc.yaml
   - service.yaml
+  - deployment.yaml

package/manifests/grafana/service.yaml

@@ -11,4 +11,9 @@ spec:
   selector:
     app: grafana
   sessionAffinity: None
-  type: LoadBalancer
+  # ClusterIP: this Service is what Prometheus' provisioned datasource and the
+  # edge route resolve. Browser access is a separate decision, published by
+  # `monitor --grafana-host` (edge route) or `--node-port` (LAN), so a cluster
+  # with no LoadBalancer controller does not sit on a Service that never gets an
+  # address.
+  type: ClusterIP

package/manifests/mariadb/pv.yaml

@@ -10,3 +10,4 @@ spec:
     - ReadWriteOnce
   hostPath:
     path: /data/mariadb
+    type: DirectoryOrCreate

package/manifests/mongodb/statefulset.yaml

@@ -55,6 +55,12 @@ spec:
             - '--keyFile'
             - '/opt/mongodb/mongodb-keyfile'
             - '--bind_ip_all'
+            # Pinned, not inferred. mongod sizes its cache from the cgroup limit and lands on
+            # the 256MB floor, which leaves no headroom for a `mongodump` running in this same
+            # container — the dump gets OOM-killed (exit 137), the container restarts, and the
+            # replica set re-elects mid-backup.
+            - '--wiredTigerCacheSizeGB'
+            - '0.25'
 
           ports:
             - containerPort: 27017
@@ -91,10 +97,11 @@ spec:
           resources:
             requests:
               cpu: '100m'
-              memory: '256Mi'
+              memory: '512Mi'
             limits:
               cpu: '500m'
-              memory: '512Mi'
+              # 256MB WiredTiger cache + connections + an in-container mongodump/mongorestore.
+              memory: '1536Mi'
       volumes:
         - name: raw-secret-keyfile-volume
           secret:

package/manifests/mysql/pv-pvc.yaml

@@ -1,4 +1,9 @@
 # pv-pvc.yaml
+# The host path lives under /data, the node storage root this platform owns and labels
+# `container_file_t`; a path outside it (the previous '/mnt/data') carries the policy default and
+# is unreadable to the unprivileged container. `claimRef` pins the volume to exactly one claim —
+# without it this PV and postgres-pv-volume were interchangeable `manual`-class volumes over the
+# same directory, so either database could bind either one and both could land on one data tree.
 apiVersion: v1
 kind: PersistentVolume
 metadata:
@@ -7,12 +12,19 @@ metadata:
     type: local
 spec:
   storageClassName: manual
+  persistentVolumeReclaimPolicy: Retain
   capacity:
     storage: 20Gi
   accessModes:
     - ReadWriteOnce
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    namespace: default
+    name: mysql-pv-claim
   hostPath:
-    path: '/mnt/data'
+    path: '/data/mysql'
+    type: DirectoryOrCreate
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
@@ -20,6 +32,7 @@ metadata:
   name: mysql-pv-claim
 spec:
   storageClassName: manual
+  volumeName: mysql-pv
   accessModes:
     - ReadWriteOnce
   resources:

package/manifests/postgresql/pv.yaml

@@ -1,3 +1,7 @@
+# The host path lives under /data, the node storage root this platform owns and labels
+# `container_file_t`. `claimRef` pins the volume to exactly one claim: this PV and mysql-pv were
+# previously interchangeable `manual`-class volumes over the same '/mnt/data' directory, so either
+# database could bind either one and both could end up writing one data tree.
 kind: PersistentVolume
 apiVersion: v1
 metadata:
@@ -7,9 +11,16 @@ metadata:
     app: postgres
 spec:
   storageClassName: manual
+  persistentVolumeReclaimPolicy: Retain
   capacity:
     storage: 5Gi
   accessModes:
     - ReadWriteMany
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    namespace: default
+    name: postgres-pv-claim
   hostPath:
-    path: '/mnt/data'
+    path: '/data/postgresql'
+    type: DirectoryOrCreate

package/manifests/postgresql/pvc.yaml

@@ -6,6 +6,7 @@ metadata:
     app: postgres
 spec:
   storageClassName: manual
+  volumeName: postgres-pv-volume
   accessModes:
     - ReadWriteMany
   resources:

package/manifests/prometheus/deployment.yaml

@@ -1,25 +1,3 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: prometheus-config
-  labels:
-    app: prometheus
-data:
-  prometheus.yml: |
-    global:
-      scrape_interval: 30s
-      evaluation_interval: 30s
-
-    scrape_configs:
-      - job_name: 'scraper'
-        metrics_path: /metrics
-        scheme: https
-        static_configs:
-          - targets: []
-        # tls_config:
-        #   insecure_skip_verify: true
-
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -37,6 +15,7 @@ spec:
       labels:
         app: prometheus
     spec:
+      serviceAccountName: prometheus
       containers:
         - name: prometheus
           image: prom/prometheus:latest
@@ -51,8 +30,22 @@ spec:
           volumeMounts:
             - name: prometheus-config
               mountPath: /etc/prometheus/
+            - name: prometheus-rules
+              mountPath: /etc/prometheus/rules/
             - name: prometheus-data
               mountPath: /prometheus
+          readinessProbe:
+            httpGet:
+              path: /-/ready
+              port: 9090
+            initialDelaySeconds: 10
+            periodSeconds: 15
+          livenessProbe:
+            httpGet:
+              path: /-/healthy
+              port: 9090
+            initialDelaySeconds: 30
+            periodSeconds: 20
           resources:
             requests:
               memory: '200Mi'
@@ -61,6 +54,9 @@ spec:
         - name: prometheus-config
           configMap:
             name: prometheus-config
+        - name: prometheus-rules
+          configMap:
+            name: prometheus-rules
         - name: prometheus-data
           emptyDir: {}
 

package/package.json

@@ -2,13 +2,13 @@
     "type": "module",
     "main": "src/index.js",
     "name": "@underpostnet/cyberia",
-    "version": "3.3.0",
+    "version": "3.3.76",
     "description": "Cyberia CLI — toolchain for the Cyberia MMO data layer, content pipeline, persistence, gRPC services, and ERC-1155 lifecycle on Hyperledger Besu.",
     "scripts": {
         "start": "node --max-old-space-size=8192 src/server",
         "build": "node bin client",
-        "test": "NODE_ENV=test c8 mocha",
-        "test:monitor": "NODE_ENV=test c8 mocha test/deploy-monitor.test.js",
+        "test": "node bin test",
+        "test:coverage": "COVERAGE_ENFORCE=1 node bin test unit,infra,app,cyberia",
         "dev": "NODE_ENV=development nodemon src/server",
         "dev:container": "NODE_ENV=development node src/server",
         "prod:container": "NODE_ENV=production node src/server",
@@ -17,7 +17,7 @@
         "dev:proxy": "NODE_ENV=development node src/proxy proxy",
         "docs": "typedoc --options typedoc.json",
         "install:global": "npm install -g prettier",
-        "install:test": "npm install -g mocha && npm install -g c8 && npm install -g coveralls-next",
+        "install:test": "npm install -g coveralls-next",
         "install": "npm run install:global && npm run install:test",
         "prettier": "prettier --write .",
         "fix": "npm audit fix --force && npm audit",
@@ -26,7 +26,6 @@
         "security:secrets:ci": "gitleaks detect --source . --config .gitleaks.toml --redact=1",
         "security:deps": "npm audit",
         "security": "npm run security:secrets:ci && npm run security:deps",
-        "clean": "node bin env clean && node bin run clean",
         "docker:generate": "node bin docker-compose --generate --deploy-id dd-cyberia --docker-compose-id cyberia",
         "docker:up": "node bin docker-compose --up --deploy-id dd-cyberia --docker-compose-id cyberia",
         "docker:up:build": "node bin docker-compose --up --build --deploy-id dd-cyberia --docker-compose-id cyberia",
@@ -41,7 +40,8 @@
         "docker:reset": "node bin docker-compose --reset --deploy-id dd-cyberia --docker-compose-id cyberia"
     },
     "bin": {
-        "cyberia": "bin/index.js"
+        "cyberia": "bin/index.js",
+        "underpost": "bin/index.js"
     },
     "repository": {
         "type": "git",
@@ -72,12 +72,11 @@
     },
     "homepage": "https://github.com/underpostnet/engine-cyberia#readme",
     "dependencies": {
-        "underpost": "^3.3.0",
-        "adm-zip": "^0.6.0",
+        "underpost": "^3.3.76",
         "maxrects-packer": "^2.7.3",
         "pngjs": "^7.0.0",
         "jimp": "^1.6.0",
-        "sharp": "^0.34.5",
+        "sharp": "^0.35.4",
         "ethers": "~6.16.0"
     },
     "publishConfig": {
@@ -90,12 +89,88 @@
         "minimatch": "^10.2.2",
         "glob": "^11.0.0",
         "diff": ">=8.0.3",
-        "js-yaml": ">=3.14.2",
+        "js-yaml": "$js-yaml",
         "debug": ">=4.3.6",
         "serialize-javascript": ">=7.0.5",
         "router": {
             "path-to-regexp": ">=8.4.0"
         },
-        "ws": "^8.20.2"
+        "ws": "^8.20.2",
+        "qs": ">=6.16.0",
+        "sharp": "^0.35.4"
+    },
+    "devDependencies": {
+        "@fortawesome/fontawesome-free": "^7.3.1",
+        "@fullcalendar/rrule": "^7.1.0",
+        "@grpc/grpc-js": "^1.14.4",
+        "@grpc/proto-loader": "^0.8.1",
+        "@neodrag/vanilla": "^2.3.1",
+        "@vitest/coverage-v8": "5.0.0",
+        "ag-grid-community": "^36.1.0",
+        "allure-vitest": "3.12.0",
+        "axios": "^1.20.0",
+        "bumpp": "^12.3.0",
+        "chai": "^6.2.2",
+        "clipboardy": "^5.3.2",
+        "cloudinary": "^2.11.0",
+        "colors": "^1.4.0",
+        "commander": "^15.0.0",
+        "compression": "^1.7.4",
+        "cookie-parser": "^1.4.7",
+        "cors": "^2.8.6",
+        "d3": "^7.9.0",
+        "dexie": "^4.4.5",
+        "dotenv": "^17.4.2",
+        "easymde": "^2.21.0",
+        "esbuild": "^0.28.2",
+        "escape-string-regexp": "^5.0.0",
+        "express": "^5.2.1",
+        "express-fileupload": "^1.4.3",
+        "express-rate-limit": "^8.7.0",
+        "express-slow-down": "^3.1.1",
+        "fast-json-stable-stringify": "^2.1.0",
+        "favicons": "^7.3.1",
+        "fs-extra": "^11.4.0",
+        "fullcalendar": "^7.1.0",
+        "helmet": "^8.3.0",
+        "html-minifier-terser": "^7.2.0",
+        "http-proxy-middleware": "^4.2.0",
+        "ignore-walk": "^9.0.0",
+        "iovalkey": "^0.4.0",
+        "js-yaml": "^5.4.1",
+        "json-colorizer": "^3.0.1",
+        "jsonwebtoken": "^9.0.3",
+        "jszip": "^3.10.2",
+        "mariadb": "^3.5.4",
+        "marked": "^18.0.11",
+        "mongoose": "^9.9.5",
+        "morgan": "^1.12.0",
+        "nodemailer": "^10.0.0",
+        "nodemon": "^3.0.1",
+        "peer": "^1.0.2",
+        "peerjs": "^1.5.5",
+        "prom-client": "^15.1.2",
+        "read": "^6.0.0",
+        "rrule": "^2.8.1",
+        "shelljs": "^0.10.0",
+        "sitemap": "^9.0.1",
+        "socket.io": "^4.8.3",
+        "sortablejs": "^1.15.0",
+        "split-file": "^2.3.0",
+        "swagger-autogen": "^2.23.7",
+        "swagger-ui-express": "^5.0.0",
+        "typedoc": "^0.28.20",
+        "typescript": "6.0.3",
+        "validator": "^13.15.35",
+        "vanilla-jsoneditor": "^3.13.0",
+        "vitest": "5.0.0",
+        "winston": "^3.19.0",
+        "workbox-background-sync": "^7.4.1",
+        "workbox-cacheable-response": "^7.4.1",
+        "workbox-core": "^7.4.1",
+        "workbox-expiration": "^7.4.1",
+        "workbox-precaching": "^7.4.1",
+        "workbox-routing": "^7.4.1",
+        "workbox-strategies": "^7.4.1"
     }
-}
+}

package/scripts/event-monitor.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+NAMESPACE="${NAMESPACE:-default}"
+TARGET_URL="${TARGET_URL:-https://underpost.net/}"
+ENVOY_NAMESPACE="${ENVOY_NAMESPACE:-envoy-gateway-system}"
+
+COLOR_CYAN='\033[0;36m'
+COLOR_GREEN='\033[0;32m'
+COLOR_YELLOW='\033[1;33m'
+COLOR_RED='\033[0;31m'
+COLOR_NC='\033[0m'
+
+echo -e "${COLOR_CYAN}=== 1. Active Probes Status (Prometheus Instant Query) ===${COLOR_NC}"
+kubectl exec -n "$NAMESPACE" deployment/prometheus -c prometheus -- \
+promtool query instant http://localhost:9090 'probe_success' || true
+
+echo -e "\n${COLOR_CYAN}=== 2. Currently Firing Alerts ===${COLOR_NC}"
+kubectl exec -n "$NAMESPACE" deployment/prometheus -c prometheus -- \
+promtool query instant http://localhost:9090 'ALERTS{alertstate="firing"}' || true
+
+echo -e "\n${COLOR_CYAN}=== 3. Blackbox Exporter Live Test (${TARGET_URL}) ===${COLOR_NC}"
+ENCODED_URL=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$TARGET_URL', safe=''))" 2>/dev/null || echo "https%3A%2F%2Funderpost.net%2F")
+kubectl get --raw "/api/v1/namespaces/$NAMESPACE/services/blackbox-exporter:9115/proxy/probe?module=http_2xx&target=${ENCODED_URL}" | grep -E "probe_success|probe_http_status_code" || true
+
+echo -e "\n${COLOR_CYAN}=== 4. Prometheus Logs (Rule Evaluation & Scraping) ===${COLOR_NC}"
+kubectl logs -n "$NAMESPACE" -l app=prometheus --tail=50 --all-containers=true
+
+echo -e "\n${COLOR_CYAN}=== 5. Alertmanager Logs (Notifications & Dispatch) ===${COLOR_NC}"
+kubectl logs -n "$NAMESPACE" -l app=alertmanager --tail=50 --all-containers=true
+
+echo -e "\n${COLOR_CYAN}=== 6. Blackbox Exporter Logs (ICMP/HTTP Probes Execution) ===${COLOR_NC}"
+kubectl logs -n "$NAMESPACE" -l app=blackbox-exporter --tail=50 --all-containers=true
+
+echo -e "\n${COLOR_CYAN}=== 7. WireGuard Interface Status ===${COLOR_NC}"
+if command -v wg &> /dev/null; then
+    echo -e "${COLOR_YELLOW}[Host WireGuard Status]${COLOR_NC}"
+    wg show || true
+    
+    echo -e "\n${COLOR_YELLOW}[WireGuard Systemd Services]${COLOR_NC}"
+    systemctl list-units --type=service 'wg-quick*' --no-pager || true
+else
+    echo -e "${COLOR_YELLOW}'wg' CLI tool is not installed on the host.${COLOR_NC}"
+fi
+
+echo -e "\n${COLOR_CYAN}=== 8. Ingress & Gateway Diagnostics ===${COLOR_NC}"
+if kubectl get ns "$ENVOY_NAMESPACE" &>/dev/null; then
+    echo -e "${COLOR_YELLOW}[Targeting namespace: ${ENVOY_NAMESPACE}]${COLOR_NC}"
+    kubectl get pods -n "$ENVOY_NAMESPACE" || true
+else
+    echo -e "${COLOR_YELLOW}[Namespace '${ENVOY_NAMESPACE}' not found. Searching cluster-wide for Ingress/Envoy resources...]${COLOR_NC}"
+    kubectl get pods -A -l "app.kubernetes.io/name in (envoy-gateway, envoy, ingress-nginx, ingress)" 2>/dev/null || \
+    kubectl get pods -A | grep -E "envoy|ingress|gateway" || true
+fi
+
+echo -e "\n${COLOR_GREEN}Done checking cluster monitoring state.${COLOR_NC}"