One more guard worth adding: wire this check to the readiness probe rather than liveness. A false unhealthy then pulls the pod out of service instead of restarting it, which avoids both the restart storm and the consumer rebalance the article describes.