CI/CD does its thing on each commit. As a last step, it uploads version stamped artifacts to S3.
If it finds one, it sleeps random seconds and then fetches and installs it.
You can also invoke a rolling restart by just using dsh to run the deploy script instead of waiting for cron.
Service name gets interpolated from terraform config into everything to hostname, ec2 tags, chef role, asg config, deploy target, binary, log file name, you name it. Hella. Useful.