Can Ory Oathkeeper route authentication traffic between two Ory Kratos versions during a zero-downtime migration?

Goal

Determine whether Ory Oathkeeper can proxy authentication requests to two Ory Kratos versions simultaneously during a zero-downtime migration of a small application.

Constraints and uncertainty

Both Kratos instances would share one identity database, so WebAuthn credential state must remain consistent across versions. OpenAPI schemas can differ between Kratos releases, and WebAuthn depends on modern browser support. It is unclear whether Oathkeeper request routing and JWT transformation can absorb version-specific response differences without breaking login or registration flows.

Questions

• Can Oathkeeper proxy traffic to multiple Kratos versions while both point to the same identity store?
• Do WebAuthn credential records remain compatible across Kratos versions during concurrent operation?
• What schema and version checks are required before enabling dual-version routing?