From 6a395213256ad303f3a29f8d8eeca1c499e581f9 Mon Sep 17 00:00:00 2001
From: GabrielPalmar <gabrielpalmarml@gmail.com>
Date: Tue, 23 Sep 2025 13:41:51 -0500
Subject: [PATCH 1/3] chore(kustomize): Added Kustomize + JSON stream to
 shorten call time

---
 app/opensense.py                              | 104 +++++++++--
 kustomize/cronjob.yaml                        |  62 +++++++
 kustomize/deployment.yaml                     | 164 ++++++++++++++++++
 kustomize/ingress.yaml                        |  21 +++
 kustomize/kustomization.yaml                  |  13 ++
 kustomize/overlays/prod/deployment-patch.yaml |  11 ++
 kustomize/overlays/prod/ingress-patch.yaml    |  16 ++
 kustomize/overlays/prod/kustomization.yaml    |   9 +
 kustomize/overlays/staging/cronjob-patch.yaml |   6 +
 .../overlays/staging/deployment-patch.yaml    |  11 ++
 kustomize/overlays/staging/ingress-patch.yaml |  16 ++
 kustomize/overlays/staging/kustomization.yaml |  10 ++
 kustomize/service.yaml                        |  36 ++++
 version.txt                                   |   2 +-
 14 files changed, 464 insertions(+), 17 deletions(-)
 create mode 100644 kustomize/cronjob.yaml
 create mode 100644 kustomize/deployment.yaml
 create mode 100644 kustomize/ingress.yaml
 create mode 100644 kustomize/kustomization.yaml
 create mode 100644 kustomize/overlays/prod/deployment-patch.yaml
 create mode 100644 kustomize/overlays/prod/ingress-patch.yaml
 create mode 100644 kustomize/overlays/prod/kustomization.yaml
 create mode 100644 kustomize/overlays/staging/cronjob-patch.yaml
 create mode 100644 kustomize/overlays/staging/deployment-patch.yaml
 create mode 100644 kustomize/overlays/staging/ingress-patch.yaml
 create mode 100644 kustomize/overlays/staging/kustomization.yaml
 create mode 100644 kustomize/service.yaml

diff --git a/app/opensense.py b/app/opensense.py
index 03500cd..352ec12 100644
--- a/app/opensense.py
+++ b/app/opensense.py
@@ -1,6 +1,6 @@
 '''Module to get entries from OpenSenseMap API and get the average temperature'''
 from datetime import datetime, timezone, timedelta
-import re
+import json
 import requests
 import redis
 from app.config import create_redis_client, CACHE_TTL
@@ -26,6 +26,33 @@ def classify_temperature(average):
 
     return "Unknown"  # Default case
 
+def _parse_partial_json_array(text: str):
+    """Parse as many full objects as possible from a (possibly truncated) JSON array."""
+    decoder = json.JSONDecoder()
+    items = []
+    i = text.find('[')
+    if i == -1:
+        return items
+    i += 1  # past '['
+    n = len(text)
+    while i < n:
+        while i < n and text[i].isspace():
+            i += 1
+        if i >= n or text[i] == ']':
+            break
+        try:
+            obj, end = decoder.raw_decode(text, i)
+        except json.JSONDecodeError:
+            # truncated object at the end; stop with what we have
+            break
+        items.append(obj)
+        i = end
+        while i < n and text[i].isspace():
+            i += 1
+        if i < n and text[i] == ',':
+            i += 1
+    return items
+
 def get_temperature():
     '''Function to get the average temperature from OpenSenseMap API.'''
     if REDIS_AVAILABLE:
@@ -33,9 +60,9 @@ def get_temperature():
             cached_data = redis_client.get("temperature_data")
             if cached_data:
                 print("Using cached data from Redis.")
-                # Return cached data with default stats (since we don't have fresh stats)
+                cached_result = cached_data.decode('utf-8')
                 default_stats = {"total_sensors": 0, "null_count": 0}
-                return cached_data, default_stats
+                return cached_result, default_stats
         except redis.RedisError as e:
             print(f"Redis error: {e}. Proceeding without cache.")
 
@@ -49,14 +76,56 @@ def get_temperature():
         "format": "json"
     }
 
+    # Streaming configuration
+    max_mb = 0.5
+    max_bytes = int(max_mb * 1024 * 1024)
+
     print('Getting data from OpenSenseMap API...')
+
     try:
+        # Stream the response and count bytes
         response = requests.get(
             "https://api.opensensemap.org/boxes",
             params=params,
-            timeout=(3, 10)
+            stream=True,
+            timeout=(180, 60)
         )
-        print('Data retrieved successfully!')
+        response.raise_for_status()
+
+        downloaded = 0
+        chunks = []
+        truncated = False
+
+        for chunk in response.iter_content(chunk_size=64 * 1024):  # 64 KB
+            if not chunk:
+                break
+            chunks.append(chunk)
+            downloaded += len(chunk)
+            if downloaded >= max_bytes:
+                print(f"Reached {max_mb} MB limit ({downloaded:,} bytes), stopping download")
+                truncated = True
+                response.close()
+                break
+
+        print(f'Bytes downloaded: {downloaded:,}')
+        print('Data retrieved successfully!' + (" (partial)" if truncated else ""))
+
+        # Build body and parse JSON
+        body = b"".join(chunks)
+        text = body.decode(response.encoding or "utf-8", errors="replace")
+
+        try:
+            data = json.loads(text)
+        except json.JSONDecodeError:
+            if not truncated:
+                print("Warning: Unexpected JSON parse error. Trying partial parse.")
+            data = _parse_partial_json_array(text)
+            if not data:
+                return "Error: Failed to parse JSON and no partial objects found\n", {
+                    "total_sensors": 0,
+                    "null_count": 0
+                    }
+
     except requests.Timeout:
         print("API request timed out")
         return "Error: API request timed out\n", {"total_sensors": 0, "null_count": 0}
@@ -64,26 +133,29 @@ def get_temperature():
         print(f"API request failed: {e}")
         return f"Error: API request failed - {e}\n", {"total_sensors": 0, "null_count": 0}
 
-    _sensor_stats["total_sensors"] = sum(
-        1 for line in response.text.splitlines() if re.search(r'^\s*"sensors"\s*:\s*\[', line)
-    )
-
-    res = [d.get('sensors') for d in response.json() if 'sensors' in d]
+    # Process the data (keeping the existing logic)
+    _sensor_stats["total_sensors"] = sum(1 for d in data if isinstance(d, dict) and "sensors" in d)
+    res = [d.get('sensors') for d in data if isinstance(d, dict) and 'sensors' in d]
 
     temp_list = []
-    _sensor_stats["null_count"] = 0  # Initialize counter for null measurements
+    _sensor_stats["null_count"] = 0
 
     for sensor_list in res:
         for measure in sensor_list:
             if measure.get('unit') == "°C" and 'lastMeasurement' in measure:
-                last_measurement = measure['lastMeasurement']
-                if last_measurement is not None and 'value' in last_measurement:
-                    last_measurement_int = float(last_measurement['value'])
-                    temp_list.append(last_measurement_int)
+                last = measure['lastMeasurement']
+                if last is not None and isinstance(last, dict) and 'value' in last:
+                    try:
+                        temp_list.append(float(last['value']))
+                    except (TypeError, ValueError):
+                        _sensor_stats["null_count"] += 1
                 else:
                     _sensor_stats["null_count"] += 1
 
-    average = sum(temp_list) / len(temp_list) if temp_list else 0
+    average = sum(temp_list) / len(temp_list) if temp_list else 0.0
+
+    if not temp_list:
+        print("Warning: No valid temperature readings found")
 
     # Use the dictionary-based classification
     status = classify_temperature(average)
diff --git a/kustomize/cronjob.yaml b/kustomize/cronjob.yaml
new file mode 100644
index 0000000..38572ff
--- /dev/null
+++ b/kustomize/cronjob.yaml
@@ -0,0 +1,62 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: temperature-storage-cronjob
+  labels:
+    app: hivebox-cronjob
+spec:
+  schedule: "*/5 * * * *"
+  concurrencyPolicy: Forbid
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          restartPolicy: OnFailure
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsGroup: 1000
+            runAsUser: 1000
+            capabilities:
+              drop: ["ALL"]
+          initContainers:
+            - name: wait-for-start
+              image: curlimages/curl:8.15.0@sha256:4026b29997dc7c823b51c164b71e2b51e0fd95cce4601f78202c513d97da2922
+              command: ["/bin/sh", "-c"]
+              args:
+                - |
+                  set -eu
+                  while true; do
+                    if curl -sSf -m 3 http://hivebox-service/version >/dev/null; then
+                      echo "Hivebox service is up!"
+                      exit 0
+                    else
+                      echo "Waiting for Hivebox service to be available..."
+                      sleep 5
+                    fi
+                  done
+          containers:
+            - name: temperature-storage
+              image: curlimages/curl:8.15.0@sha256:4026b29997dc7c823b51c164b71e2b51e0fd95cce4601f78202c513d97da2922
+              command: ["curl"]
+              args:
+                - "-f"
+                - "-s"
+                - "-S"
+                - "--max-time"
+                - "60"
+                - "http://hivebox-service/store"
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsNonRoot: true
+                runAsGroup: 1000
+                runAsUser: 1000
+                capabilities:
+                  drop: ["ALL"]
+              resources:
+                limits: { memory: "32Mi", cpu: "50m" }
+                requests: { memory: "16Mi", cpu: "10m" }
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 1
diff --git a/kustomize/deployment.yaml b/kustomize/deployment.yaml
new file mode 100644
index 0000000..919e634
--- /dev/null
+++ b/kustomize/deployment.yaml
@@ -0,0 +1,164 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hivebox
+  labels:
+    app: hivebox
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: hivebox
+  template:
+    metadata:
+      labels:
+        app: hivebox
+    spec:
+      securityContext:
+        fsGroup: 1000
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+      containers:
+        - name: hivebox
+          image: ghcr.io/gabrielpalmar/hivebox:latest@sha256:c731999c3fd9b757e2fd816e3c9dcf645dba56647d8a921cb567ece3cf378dc3
+          ports:
+            - containerPort: 5000
+          env:
+            - name: REDIS_HOST
+              value: redis-service
+            - name: MINIO_HOST
+              value: minio-service
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          resources:
+            limits: { memory: "512Mi", cpu: "500m" }
+            requests: { memory: "256Mi", cpu: "250m" }
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: 5000
+            initialDelaySeconds: 30
+            timeoutSeconds: 480
+            failureThreshold: 3
+            periodSeconds: 600
+          livenessProbe:
+            httpGet:
+              path: /version
+              port: 5000
+            timeoutSeconds: 3
+            failureThreshold: 3
+            periodSeconds: 60
+          volumeMounts:
+            - name: tmp-volume
+              mountPath: /tmp
+      volumes:
+        - name: tmp-volume
+          emptyDir: {}
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: redis
+  labels:
+    app: redis
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: redis
+  template:
+    metadata:
+      labels:
+        app: redis
+    spec:
+      securityContext:
+        allowPrivilegeEscalation: false
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsGroup: 1000
+        runAsUser: 1000
+        capabilities:
+          drop: ["ALL"]
+      containers:
+        - name: valkey
+          image: valkey/valkey:8-alpine3.22@sha256:0d27f0bca0249f61d060029a6aaf2e16b2c417d68d02a508e1dfb763fa2948b4
+          ports:
+            - containerPort: 6379
+          command: ["valkey-server"]
+          args: ["--save", "", "--appendonly", "no"]
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsGroup: 1000
+            runAsUser: 1000
+            capabilities:
+              drop: ["ALL"]
+          resources:
+            limits: { memory: "256Mi", cpu: "250m" }
+            requests: { memory: "128Mi", cpu: "100m" }
+          volumeMounts:
+            - name: valkey-data
+              mountPath: /data
+      volumes:
+        - name: valkey-data
+          emptyDir: {}
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: minio
+  labels:
+    app: minio
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: minio
+  template:
+    metadata:
+      labels:
+        app: minio
+    spec:
+      securityContext:
+        allowPrivilegeEscalation: false
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsGroup: 1000
+        runAsUser: 1000
+        capabilities:
+          drop: ["ALL"]
+      containers:
+        - name: minio
+          image: minio/minio:RELEASE.2025-07-23T15-54-02Z@sha256:d249d1fb6966de4d8ad26c04754b545205ff15a62e4fd19ebd0f26fa5baacbc0
+          ports:
+            - containerPort: 9000
+          command: ["minio", "server", "/data"]
+          env:
+            - name: MINIO_ROOT_USER
+              value: minioadmin
+            - name: MINIO_ROOT_PASSWORD
+              value: minioadmin
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsGroup: 1000
+            runAsUser: 1000
+            capabilities:
+              drop: ["ALL"]
+          resources:
+            limits: { memory: "256Mi", cpu: "250m" }
+            requests: { memory: "128Mi", cpu: "100m" }
+          volumeMounts:
+            - name: minio-data
+              mountPath: /data
+      volumes:
+        - name: minio-data
+          emptyDir: {}
diff --git a/kustomize/ingress.yaml b/kustomize/ingress.yaml
new file mode 100644
index 0000000..757ef7f
--- /dev/null
+++ b/kustomize/ingress.yaml
@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: hivebox-ingress
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: /
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: hivebox.local
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: hivebox-service
+                port:
+                  number: 80
diff --git a/kustomize/kustomization.yaml b/kustomize/kustomization.yaml
new file mode 100644
index 0000000..0680c0a
--- /dev/null
+++ b/kustomize/kustomization.yaml
@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: hivebox
+
+resources:
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml
+  - cronjob.yaml
+
+commonLabels:
+  app: hivebox
diff --git a/kustomize/overlays/prod/deployment-patch.yaml b/kustomize/overlays/prod/deployment-patch.yaml
new file mode 100644
index 0000000..b58fab5
--- /dev/null
+++ b/kustomize/overlays/prod/deployment-patch.yaml
@@ -0,0 +1,11 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hivebox
+spec:
+  replicas: 3
+  template:
+    spec:
+      containers:
+        - name: hivebox
+          image: ghcr.io/gabrielpalmar/hivebox:0.7.0
diff --git a/kustomize/overlays/prod/ingress-patch.yaml b/kustomize/overlays/prod/ingress-patch.yaml
new file mode 100644
index 0000000..5226119
--- /dev/null
+++ b/kustomize/overlays/prod/ingress-patch.yaml
@@ -0,0 +1,16 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: hivebox-ingress
+spec:
+  rules:
+    - host: hivebox.example.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: hivebox-service
+                port:
+                  number: 80
diff --git a/kustomize/overlays/prod/kustomization.yaml b/kustomize/overlays/prod/kustomization.yaml
new file mode 100644
index 0000000..3cc8477
--- /dev/null
+++ b/kustomize/overlays/prod/kustomization.yaml
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../
+commonLabels:
+  env: prod
+patchesStrategicMerge:
+  - deployment-patch.yaml
+  - ingress-patch.yaml
diff --git a/kustomize/overlays/staging/cronjob-patch.yaml b/kustomize/overlays/staging/cronjob-patch.yaml
new file mode 100644
index 0000000..8a65220
--- /dev/null
+++ b/kustomize/overlays/staging/cronjob-patch.yaml
@@ -0,0 +1,6 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: temperature-storage-cronjob
+spec:
+  schedule: "*/10 * * * *"
diff --git a/kustomize/overlays/staging/deployment-patch.yaml b/kustomize/overlays/staging/deployment-patch.yaml
new file mode 100644
index 0000000..dfc82b5
--- /dev/null
+++ b/kustomize/overlays/staging/deployment-patch.yaml
@@ -0,0 +1,11 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hivebox
+spec:
+  replicas: 1
+  template:
+    spec:
+      containers:
+        - name: hivebox
+          image: ghcr.io/gabrielpalmar/hivebox:0.7.0@sha256:c731999c3fd9b757e2fd816e3c9dcf645dba56647d8a921cb567ece3cf378dc3
diff --git a/kustomize/overlays/staging/ingress-patch.yaml b/kustomize/overlays/staging/ingress-patch.yaml
new file mode 100644
index 0000000..7d01cb9
--- /dev/null
+++ b/kustomize/overlays/staging/ingress-patch.yaml
@@ -0,0 +1,16 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: hivebox-ingress
+spec:
+  rules:
+    - host: staging.hivebox.local
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: hivebox-service
+                port:
+                  number: 80
diff --git a/kustomize/overlays/staging/kustomization.yaml b/kustomize/overlays/staging/kustomization.yaml
new file mode 100644
index 0000000..feb8f3b
--- /dev/null
+++ b/kustomize/overlays/staging/kustomization.yaml
@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../
+commonLabels:
+  env: staging
+patchesStrategicMerge:
+  - deployment-patch.yaml
+  - ingress-patch.yaml
+  - cronjob-patch.yaml
diff --git a/kustomize/service.yaml b/kustomize/service.yaml
new file mode 100644
index 0000000..c17f307
--- /dev/null
+++ b/kustomize/service.yaml
@@ -0,0 +1,36 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: hivebox-service
+  labels:
+    app: hivebox
+spec:
+  selector:
+    app: hivebox
+  ports:
+    - port: 80
+      targetPort: 5000
+      protocol: TCP
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis-service
+spec:
+  selector:
+    app: redis
+  ports:
+    - port: 6379
+      targetPort: 6379
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: minio-service
+spec:
+  selector:
+    app: minio
+  ports:
+    - port: 9000
+      targetPort: 9000
\ No newline at end of file
diff --git a/version.txt b/version.txt
index bcaffe1..7deb86f 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-0.7.0
\ No newline at end of file
+0.7.1
\ No newline at end of file

From 3488fc9c7833a5e32f01e742f545021e5a39174f Mon Sep 17 00:00:00 2001
From: GabrielPalmar <gabrielpalmarml@gmail.com>
Date: Tue, 23 Sep 2025 13:54:05 -0500
Subject: [PATCH 2/3] fix(ci): Disabling some PyLint warnings

---
 app/storage.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/app/storage.py b/app/storage.py
index d93d60f..76e57b4 100644
--- a/app/storage.py
+++ b/app/storage.py
@@ -1,4 +1,5 @@
 '''This script uploads the output to a MinIO bucket.'''
+# pylint: disable=too-many-locals,too-many-branches,too-many-statements
 import os
 import io
 import datetime

From 482ec1d09a32ec3197d16a6dcdee878e4ef20288 Mon Sep 17 00:00:00 2001
From: GabrielPalmar <gabrielpalmarml@gmail.com>
Date: Wed, 24 Sep 2025 13:07:48 -0500
Subject: [PATCH 3/3] fix(kustomize): Resolving issues

---
 app/opensense.py                                  |  1 +
 app/storage.py                                    |  1 -
 kustomize/{ => base}/cronjob.yaml                 | 15 ++++++++++-----
 kustomize/{ => base}/deployment.yaml              | 14 ++++----------
 kustomize/{ => base}/ingress.yaml                 |  0
 kustomize/{ => base}/kustomization.yaml           |  8 +++-----
 kustomize/{ => base}/service.yaml                 |  0
 .../overlays/{staging => prod}/cronjob-patch.yaml |  0
 kustomize/overlays/prod/kustomization.yaml        | 14 ++++++++------
 kustomize/overlays/staging/kustomization.yaml     | 14 +++++++-------
 10 files changed, 33 insertions(+), 34 deletions(-)
 rename kustomize/{ => base}/cronjob.yaml (86%)
 rename kustomize/{ => base}/deployment.yaml (94%)
 rename kustomize/{ => base}/ingress.yaml (100%)
 rename kustomize/{ => base}/kustomization.yaml (81%)
 rename kustomize/{ => base}/service.yaml (100%)
 rename kustomize/overlays/{staging => prod}/cronjob-patch.yaml (100%)

diff --git a/app/opensense.py b/app/opensense.py
index 352ec12..aa03a5d 100644
--- a/app/opensense.py
+++ b/app/opensense.py
@@ -1,4 +1,5 @@
 '''Module to get entries from OpenSenseMap API and get the average temperature'''
+# pylint: disable=too-many-locals,too-many-branches,too-many-statements
 from datetime import datetime, timezone, timedelta
 import json
 import requests
diff --git a/app/storage.py b/app/storage.py
index 76e57b4..d93d60f 100644
--- a/app/storage.py
+++ b/app/storage.py
@@ -1,5 +1,4 @@
 '''This script uploads the output to a MinIO bucket.'''
-# pylint: disable=too-many-locals,too-many-branches,too-many-statements
 import os
 import io
 import datetime
diff --git a/kustomize/cronjob.yaml b/kustomize/base/cronjob.yaml
similarity index 86%
rename from kustomize/cronjob.yaml
rename to kustomize/base/cronjob.yaml
index 38572ff..dc05595 100644
--- a/kustomize/cronjob.yaml
+++ b/kustomize/base/cronjob.yaml
@@ -13,13 +13,10 @@ spec:
         spec:
           restartPolicy: OnFailure
           securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
+            fsGroup: 1000
             runAsNonRoot: true
-            runAsGroup: 1000
             runAsUser: 1000
-            capabilities:
-              drop: ["ALL"]
+            runAsGroup: 1000
           initContainers:
             - name: wait-for-start
               image: curlimages/curl:8.15.0@sha256:4026b29997dc7c823b51c164b71e2b51e0fd95cce4601f78202c513d97da2922
@@ -36,6 +33,14 @@ spec:
                       sleep 5
                     fi
                   done
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                runAsNonRoot: true
+                runAsGroup: 1000
+                runAsUser: 1000
+                capabilities:
+                  drop: ["ALL"]
           containers:
             - name: temperature-storage
               image: curlimages/curl:8.15.0@sha256:4026b29997dc7c823b51c164b71e2b51e0fd95cce4601f78202c513d97da2922
diff --git a/kustomize/deployment.yaml b/kustomize/base/deployment.yaml
similarity index 94%
rename from kustomize/deployment.yaml
rename to kustomize/base/deployment.yaml
index 919e634..604e4a0 100644
--- a/kustomize/deployment.yaml
+++ b/kustomize/base/deployment.yaml
@@ -77,13 +77,10 @@ spec:
         app: redis
     spec:
       securityContext:
-        allowPrivilegeEscalation: false
-        readOnlyRootFilesystem: true
+        fsGroup: 1000
         runAsNonRoot: true
-        runAsGroup: 1000
         runAsUser: 1000
-        capabilities:
-          drop: ["ALL"]
+        runAsGroup: 1000
       containers:
         - name: valkey
           image: valkey/valkey:8-alpine3.22@sha256:0d27f0bca0249f61d060029a6aaf2e16b2c417d68d02a508e1dfb763fa2948b4
@@ -127,13 +124,10 @@ spec:
         app: minio
     spec:
       securityContext:
-        allowPrivilegeEscalation: false
-        readOnlyRootFilesystem: true
+        fsGroup: 1000
         runAsNonRoot: true
-        runAsGroup: 1000
         runAsUser: 1000
-        capabilities:
-          drop: ["ALL"]
+        runAsGroup: 1000
       containers:
         - name: minio
           image: minio/minio:RELEASE.2025-07-23T15-54-02Z@sha256:d249d1fb6966de4d8ad26c04754b545205ff15a62e4fd19ebd0f26fa5baacbc0
diff --git a/kustomize/ingress.yaml b/kustomize/base/ingress.yaml
similarity index 100%
rename from kustomize/ingress.yaml
rename to kustomize/base/ingress.yaml
diff --git a/kustomize/kustomization.yaml b/kustomize/base/kustomization.yaml
similarity index 81%
rename from kustomize/kustomization.yaml
rename to kustomize/base/kustomization.yaml
index 0680c0a..a64e1fd 100644
--- a/kustomize/kustomization.yaml
+++ b/kustomize/base/kustomization.yaml
@@ -1,13 +1,11 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-
 namespace: hivebox
-
 resources:
   - deployment.yaml
   - service.yaml
   - ingress.yaml
   - cronjob.yaml
-
-commonLabels:
-  app: hivebox
+metadata:
+  labels:
+    app: hivebox
diff --git a/kustomize/service.yaml b/kustomize/base/service.yaml
similarity index 100%
rename from kustomize/service.yaml
rename to kustomize/base/service.yaml
diff --git a/kustomize/overlays/staging/cronjob-patch.yaml b/kustomize/overlays/prod/cronjob-patch.yaml
similarity index 100%
rename from kustomize/overlays/staging/cronjob-patch.yaml
rename to kustomize/overlays/prod/cronjob-patch.yaml
diff --git a/kustomize/overlays/prod/kustomization.yaml b/kustomize/overlays/prod/kustomization.yaml
index 3cc8477..33f48d5 100644
--- a/kustomize/overlays/prod/kustomization.yaml
+++ b/kustomize/overlays/prod/kustomization.yaml
@@ -1,9 +1,11 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ../../
-commonLabels:
-  env: prod
-patchesStrategicMerge:
-  - deployment-patch.yaml
-  - ingress-patch.yaml
+  - ../../base
+labels:
+  - pairs:
+      env: prod
+patches:
+  - path: deployment-patch.yaml
+  - path: ingress-patch.yaml
+  - path: cronjob-patch.yaml
diff --git a/kustomize/overlays/staging/kustomization.yaml b/kustomize/overlays/staging/kustomization.yaml
index feb8f3b..1ec5d1b 100644
--- a/kustomize/overlays/staging/kustomization.yaml
+++ b/kustomize/overlays/staging/kustomization.yaml
@@ -1,10 +1,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ../../
-commonLabels:
-  env: staging
-patchesStrategicMerge:
-  - deployment-patch.yaml
-  - ingress-patch.yaml
-  - cronjob-patch.yaml
+  - ../../base
+labels:
+  - pairs:
+      env: staging
+patches:
+  - path: deployment-patch.yaml
+  - path: ingress-patch.yaml