Zero-downtime cutovers

An ExternalName stub kept a region's logins alive through a namespace migration

A CNCF blog post walks through moving an authentication service that a whole region logged in through. The interesting part is that its internal DNS path and its ingress path have different tolerances for overlap.