Update instances one at a time. Each new instance is health-checked before moving on to the next. If a health check fails, the rollout stops and previous instances continue serving traffic.