If a DNSSec-signed sone suddenly replace both ZSK (and all records related to the old ZSK), and at the same time keep the KSKs (which are referenced to by upstream server). Will it cause any trouble?
Yes. You seem to forget that DNS records have TTL. So recursive resolvers will/may have the old key data in their cache (the DNSKEY records listing the old ZSKs), and hence expect for example to find signatures with it. "Suddenly" never mixes will with DNS. No changes should be done without grace periods.
From what I have gathered, it is not possible to migrate the ZSKs for a zone, but it is possible to migrate the KSKs.
It is not clear to me what you mean by "migrate" there. ZSKs, by definition, are rotated often, like one each month or each 2 months, but with overlapping.
No matter what, you have always this ugly method to change things, that works but opens a window of no security:
- remove DS at parent
- wait "enough" time (at least
DS TTL and some more)
- now your zone is not DNSSEC secured anymore, you can mutate its content at your will, including about keys
- once you reached your new desired configuration, and you have tested that DNSSEC is ok by simulating a specific
DS at parent, then you can put that DS record back at parent.
Of course, if you have any monitoring on your zone that expects DNSSEC, it will scream during the procedure (or at least good test for the monitoring too).
