What does a Spring Boot Actuator health check for Kafka actually verify, and why might a service still be 'unhealthy' even if it's technically running?

It typically verifies the application can reach the Kafka broker (a lightweight connectivity/metadata check). A service can be 'up' as a process yet unable to produce or consume anything useful if it's lost broker connectivity — surfacing that as an explicit unhealthy state lets Kubernetes stop routing traffic to it rather than silently failing requests.