maxUnavailable=0 ensures old pod stays up until new pod passes readiness probes. maxSurge=1 allows one extra pod during rollout.