A rolling update replaces old Pods with new ones incrementally, keeping the service available throughout. Kubernetes creates new Pods from the new ReplicaSet while terminating old ones based on maxSurge and maxUnavailable settings.

maxSurge: 1 allows one extra Pod above desired during the update. maxUnavailable: 0 ensures no capacity is lost - every old Pod waits for a new one to become Ready before it terminates. Readiness probes gate the rollout - a new Pod is not counted as Ready until its probe passes. A failed rollout is stopped automatically; kubectl rollout undo restores the previous ReplicaSet.