Application Gateway Traffic Splitting vs. SSH Tunneling for Non-HTTP Zero-Downtime Migration

Migration Goal and Constraint

A small Teleport-managed application must be migrated to new instances with zero downtime. Teleport's Application Gateway (introduced in v12) provides HTTP(S) traffic splitting, allowing gradual shift of web traffic while preserving SSO sessions and identity mappings.

Protocol Limitation

The Application Gateway only supports HTTP(S) traffic. The application also exposes non-HTTP services (raw TCP/UDP) that require equivalent zero-downtime migration, but Teleport lacks a documented traffic-splitting mechanism for these protocols.

Open Decision

It is unclear whether combining Application Gateway for HTTP(S) with SSH tunneling for non-HTTP traffic can achieve coordinated traffic splitting without breaking session affinity or SSO token continuity across both paths.

Does Teleport document any pattern for extending traffic splitting to non-HTTP protocols via SSH tunnels? What are the session-affinity implications when mixing Application Gateway and SSH-based forwarding? Are there version-specific limitations (pre-v12 vs v12+) that affect this hybrid approach?