Symptom84 problems· 11 reviewed

404 and Rewrite Mismatch

84 incident problems that show up as “404 and Rewrite Mismatch”.

Read first

When DNS changed but some clients still hit the old backendAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when the DNS record is updated but resolver cache, HTTP/2 keepalive, or client pools hold on to the old target.Network3 min read When firewalld looks open but connections keep getting blockedAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when a port rule appears to exist but the connection fails because of zone, runtime/permanent drift, source binding, or an upstream firewall.Network3 min read How to separate timeout and connection refused by network pathAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when DNS, route, firewall, proxy, and listener states all look like the same connection failure.Network3 min read

Recommended problems

Reviewed problems first, then problems with detailed scenarios.

CICD-116Registry cleanup deletes the rollback tag that the audit manifest still references as the approved fallback releaseThe platform kept the primary image, but rollback fails because governance artifacts still point at a tag the registry retention job already removed.ReviewedCI/CDIntermediate16 minFree K8S-030Ingress class mismatch sends traffic to the wrong controllerIngress class mismatch sends traffic to the wrong controller is a hands-on troubleshooting drill. Routing rules are valid, but the ingress object is reconciled by a different controller than the team expected. Kubernetes Ingress and Traffic needs to be checked by narrowing sco...ReviewedKubernetesIntermediate19 minFree Ingress 404 Not Found: only the newly added www host returns 404Ingress 404 Not Found: only the newly added www host returns 404 is a hands-on troubleshooting drill. Check that the request's host name matches an Ingress rule. NGINX Kubernetes Ingress and Traffic needs to be checked by narrowing scope, recent change, and the current live si...ReviewedKubernetesBeginner3 minFree LINUX-005A missing WorkingDirectory problem that puts a systemd service into a restart loopA situation where the application itself is fine but a wrong unit-file path setting kills the service.ReviewedLinuxIntermediate20 minFree command not found only under cron: the script works when run by handcommand not found only (404 and Rewrite Mismatch) is a hands-on troubleshooting drill. cron runs jobs with a minimal PATH. AWS scheduled-jobs needs to be checked by narrowing scope, recent change, and the current live signal before rollback. 실무에서는 scheduled-jobs 문제를 볼 때 서비스 로그...ReviewedLinuxBeginner3 minFree NETWORK-004DNS resolves on the host but not inside the containerA typical failure that appears when the container runtime's DNS settings and search domains diverge.ReviewedNetworkBeginner16 minFree

All problems (84)

Ingress 404 Not Found: only the newly added www host returns 404Ingress 404 Not Found: only the newly added www host returns 404 is a hands-on troubleshooting drill. Check that the request's host name matches an Ingress rule. NGINX Kubernetes Ingress and Traffic needs to be checked by narrowing scope, recent change, and the current live si...ReviewedKubernetesBeginner3 minFree command not found only under cron: the script works when run by handcommand not found only (404 and Rewrite Mismatch) is a hands-on troubleshooting drill. cron runs jobs with a minimal PATH. AWS scheduled-jobs needs to be checked by narrowing scope, recent change, and the current live signal before rollback. 실무에서는 scheduled-jobs 문제를 볼 때 서비스 로그...ReviewedLinuxBeginner3 minFree SECURITY-001The SSH management path is blocked after an overly narrow allowlist changeA situation where the access-control policy looks correct, but one jump-host range is missing, so the actual operations management path is blocked.ReviewedSecurityBeginner16 minFree K8S-030Ingress class mismatch sends traffic to the wrong controllerIngress class mismatch sends traffic to the wrong controller is a hands-on troubleshooting drill. Routing rules are valid, but the ingress object is reconciled by a different controller than the team expected. Kubernetes Ingress and Traffic needs to be checked by narrowing sco...ReviewedKubernetesIntermediate19 minFree LINUX-005A missing WorkingDirectory problem that puts a systemd service into a restart loopA situation where the application itself is fine but a wrong unit-file path setting kills the service.ReviewedLinuxIntermediate20 minFree CICD-116Registry cleanup deletes the rollback tag that the audit manifest still references as the approved fallback releaseThe platform kept the primary image, but rollback fails because governance artifacts still point at a tag the registry retention job already removed.ReviewedCI/CDIntermediate16 minFree NETWORK-006Only the load balancer health check is blocked by the firewall, dropping the whole serviceA situation where the application is fine but a different health-check path policy drains all traffic.ReviewedNetworkIntermediate20 minFree SECURITY-016MFA enforcement skipped for legacy admin endpointMFA enforcement skipped for legacy admin endpoint is a hands-on troubleshooting drill. The main login path correctly enforces MFA, but a secondary admin route still accepts a weaker path. Identity and Access Management needs to be checked by narrowing scope, recent change, and...ReviewedSecurityBeginner14 minFree NETWORK-004DNS resolves on the host but not inside the containerA typical failure that appears when the container runtime's DNS settings and search domains diverge.ReviewedNetworkBeginner16 minFree NETWORK-024Firewall allow rule exists but interface match is wrongFirewall allow rule exists but interface match is wrong is a hands-on troubleshooting drill. The rule looks present, yet traffic still drops because it is attached to a different input interface than expected. Firewall and Proxy Paths needs to be checked by narrowing scope, re...ReviewedNetworkBeginner14 minFree K8S-012The init container finished, but the main container cannot see the config fileA situation where the initialization step succeeded but the volume mount location differs, so only the runtime container fails.KubernetesIntermediate20 minFree CICD-018A path-filter malfunction that drops tests only on pull request eventsA path-filter malfunction that drops tests only on pull request events is a hands-on troubleshooting drill. Covers a problem where a wrong changed-file path filter drops the most important PR tests. Container Image Delivery needs to be checked by narrowing scope, recent change...CI/CDBeginner16 minFree LINUX-014A backup script that looks successful but actually keeps only an empty directoryCovers an incident where the backup output is empty because of a difference between the relative path and the current working directory.LinuxIntermediate18 minFree NETWORK-001Quickly checking the network path when containers cannot communicateA network-basics incident scenario that organizes the order of checking the bridge network, iptables, port mapping, and DNS.NetworkIntermediate21 minFree NETWORK-014The port is open but a reverse path filter keeps the response from returningA situation where incoming connections are visible but response packets are blocked by kernel policy, so the session never establishes.NetworkBeginner18 minFree SECURITY-052ACME HTTP-01 renewal failsTLS worked yesterday, but automated renewal now fails because the well-known challenge route is treated like an untrusted request pattern by the current edge policy.SecurityIntermediate20 minFree SECURITY-077Custom WAF allow rule matches but a later managed rule still blocks the requestThe operator sees the expected custom rule fire, yet traffic remains blocked because the final decision is made by a later managed rule with stronger action priority.SecurityIntermediate16 minFree CICD-070Static asset deploy uploads precompressed files without Content-Encoding metadataThe release finishes green, but browsers download broken assets because the object metadata no longer matches the precompressed files uploaded by the pipeline.CI/CDIntermediate16 minFree SECURITY-064WAF bot challenge protects the browser path but blocks webhook callbacks from non-browser clientsThe site is safer for humans, but an integration silently breaks because the challenged path now assumes browser behavior that the webhook sender never provides.SecurityIntermediate17 minFree K8S-072ExternalDNS updates the wrong hosted zoneDNS automation is healthy, but one record lands in the wrong zone because two matching filters and ownership assumptions overlap in a way the operator did not expect.KubernetesIntermediate18 minFree