Application Gateway Traffic Splitting vs. SSH Tunneling for Non-HTTP Zero-Downtime Migration

Direct Answer

For zero-downtime migration of non-HTTP services behind Teleport Application Gateway, you must treat HTTP(S) and non-HTTP traffic as separate migration paths. Teleport v12+ Application Gateway provides no native mechanism to split raw TCP/UDP protocols, and SSH tunneling cannot inherit the Gateway's session affinity or SSO token continuity.

Confirmed Behavior

Teleport Application Gateway (v12+) supports HTTP(S) traffic splitting with:

• Gradual weight-based routing between old and new instances
• Preserved SSO sessions and identity mappings
• Session affinity via cookies or headers

For non-HTTP protocols, Teleport offers no equivalent feature. SSH-based forwarding operates outside the Application Gateway's session management system.

Hybrid Approach Limitations

When combining Application Gateway (HTTP) with SSH tunnels (TCP/UDP):

1. Session contexts remain isolated — SSH tunnels maintain their own connection state; they cannot share SSO sessions with Application Gateway traffic
2. Affinity synchronization is manual — you must implement separate session tracking for each protocol path
3. Client authentication may diverge — HTTP requests carry Teleport SSO tokens, while SSH connections rely on key-based or password authentication

Practical Steps for Coordinated Migration

1. Migrate HTTP(S) first via Application Gateway — use the built-in traffic splitting to gradually shift web traffic to new instances
2. Establish SSH tunnels in parallel — create persistent tunnels to new instances using ssh -L or ssh -R for TCP/UDP services
3. Implement external session affinity — if client applications require consistent routing across protocols, deploy a shared session store (e.g., Redis) that both paths can query
4. Plan for authentication divergence — design client-side logic to handle separate authentication flows for HTTP (SSO) and SSH (key-based)
5. Decommission old instances after full cutover — once all traffic has shifted, terminate the original instances

Version Considerations

Pre-v12 versions lack Application Gateway entirely, requiring manual orchestration of all traffic. v12+ provides the HTTP splitting capability but does not extend it to non-HTTP protocols. The SSH tunnel approach works across all versions but cannot integrate with Teleport's session management.

Missing Diagnostic Detail

What specific non-HTTP protocols are required (e.g., database connections, custom TCP services)? This determines whether SSH tunneling is viable or if a different approach like HAProxy or WireGuard might be more appropriate.