What happens during a Kubernetes rolling update?

The Deployment controller incrementally creates new Pods with the updated spec (bounded by maxSurge, how many extra Pods can exist temporarily) and, once each new Pod passes its readiness probe, terminates a corresponding old Pod (bounded by maxUnavailable, how many can be down at once). This continues until all old Pods are replaced; if new Pods fail readiness checks, the rollout can be configured to halt or the operator can issue a rollback to the previous ReplicaSet.