From d0b896b01c53ecbf94aadd4cc084e21e1c5e0790 Mon Sep 17 00:00:00 2001
From: jgrusewski <jgrusewski@localhost>
Date: Mon, 2 Mar 2026 14:37:51 +0100
Subject: [PATCH] fix(infra): probe TWS API port 4002, use Recreate strategy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Readiness/liveness probes were checking port 4004 (socat), which
always listens even when the gateway is stuck at login — masking
failures. Now probes check port 4002 (TWS API), which only opens
after successful IBKR authentication.

Deploy strategy changed to Recreate because IBKR allows only one
session per account. RollingUpdate starts the new pod before killing
the old one, causing both to fight over the session in a crash loop.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 infra/k8s/services/ib-gateway.yaml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/infra/k8s/services/ib-gateway.yaml b/infra/k8s/services/ib-gateway.yaml
index 598e9d5fc..3c036df6a 100644
--- a/infra/k8s/services/ib-gateway.yaml
+++ b/infra/k8s/services/ib-gateway.yaml
@@ -8,6 +8,8 @@ metadata:
     app.kubernetes.io/part-of: foxhunt
 spec:
   replicas: 1
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: ib-gateway
@@ -77,12 +79,12 @@ spec:
               cpu: "1000m"
           readinessProbe:
             tcpSocket:
-              port: 4004
+              port: 4002
             initialDelaySeconds: 90
             periodSeconds: 10
           livenessProbe:
             tcpSocket:
-              port: 4004
+              port: 4002
             initialDelaySeconds: 120
             periodSeconds: 30
             failureThreshold: 5