@@ -27,8 +27,10 @@ import (
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/collectors"
 	"go.uber.org/zap/zapcore"
+	"google.golang.org/grpc/connectivity"
 	appsv1 "k8s.io/api/apps/v1"
 	apimetrics "k8s.io/apiserver/pkg/endpoints/metrics"
+	"k8s.io/apiserver/pkg/server/healthz"
 	"k8s.io/client-go/kubernetes/scheme"
 	kubemetrics "k8s.io/component-base/metrics"
 	"k8s.io/component-base/metrics/legacyregistry"
@@ -70,20 +72,20 @@ var (
 	stdErrThreshold             string
 )
 
-func (a *Adapter) makeProvider(ctx context.Context) (provider.ExternalMetricsProvider, error) {
+func (a *Adapter) makeProvider(ctx context.Context) (provider.ExternalMetricsProvider, *metricsservice.GrpcClient, error) {
 	scheme := scheme.Scheme
 	if err := appsv1.SchemeBuilder.AddToScheme(scheme); err != nil {
 		setupLog.Error(err, "failed to add apps/v1 scheme to runtime scheme")
-		return nil, fmt.Errorf("failed to add apps/v1 scheme to runtime scheme (%s)", err)
+		return nil, nil, fmt.Errorf("failed to add apps/v1 scheme to runtime scheme (%s)", err)
 	}
 	if err := kedav1alpha1.SchemeBuilder.AddToScheme(scheme); err != nil {
 		setupLog.Error(err, "failed to add keda scheme to runtime scheme")
-		return nil, fmt.Errorf("failed to add keda scheme to runtime scheme (%s)", err)
+		return nil, nil, fmt.Errorf("failed to add keda scheme to runtime scheme (%s)", err)
 	}
 	namespaces, err := kedautil.GetWatchNamespaces()
 	if err != nil {
 		setupLog.Error(err, "failed to get watch namespace")
-		return nil, fmt.Errorf("failed to get watch namespace (%s)", err)
+		return nil, nil, fmt.Errorf("failed to get watch namespace (%s)", err)
 	}
 
 	// Get a config to talk to the apiserver
@@ -107,23 +109,23 @@ func (a *Adapter) makeProvider(ctx context.Context) (provider.ExternalMetricsPro
 	})
 	if err != nil {
 		setupLog.Error(err, "failed to setup manager")
-		return nil, err
+		return nil, nil, err
 	}
 
 	setupLog.Info("Connecting Metrics Service gRPC client to the server", "address", metricsServiceAddr)
 	defaultConnectionCfg := ""
 	grpcClient, err := metricsservice.NewGrpcClient(ctx, metricsServiceAddr, a.SecureServing.ServerCert.CertDirectory, metricsServiceGRPCAuthority, defaultConnectionCfg, clientMetrics, false)
 	if err != nil {
 		setupLog.Error(err, "error connecting Metrics Service gRPC client to the server", "address", metricsServiceAddr)
-		return nil, err
+		return nil, nil, err
 	}
 	go func() {
 		if err := mgr.Start(ctx); err != nil {
 			setupLog.Error(err, "controller-runtime encountered an error")
 			os.Exit(1)
 		}
 	}()
-	return kedaprovider.NewProvider(ctx, setupLog, mgr.GetClient(), *grpcClient), nil
+	return kedaprovider.NewProvider(ctx, setupLog, mgr.GetClient(), *grpcClient), grpcClient, nil
 }
 
 // getMetricHandler returns a http handler that exposes metrics from controller-runtime and apiserver
@@ -305,13 +307,23 @@ func main() {
 		return
 	}
 
-	kedaProvider, err := cmd.makeProvider(ctx)
+	kedaProvider, grpcClient, err := cmd.makeProvider(ctx)
 	if err != nil {
 		setupLog.Error(err, "making provider")
 		return
 	}
 	cmd.WithExternalMetrics(kedaProvider)
 
+	// Register a readiness check that reflects the state of the gRPC connection
+	// to the KEDA metrics service (keda-operator). Without it the adapter keeps
+	// reporting Ready even when this connection is down, so the APIService keeps
+	// routing external-metric requests to a replica that can only fail them.
+	// See https://github.com/kedacore/keda/issues/8211.
+	if err = addGrpcConnectionReadyzCheck(cmd, grpcClient); err != nil {
+		setupLog.Error(err, "unable to register gRPC connection readiness check")
+		return
+	}
+
 	setupLog.Info(cmd.Message)
 
 	RunMetricsServer(ctx)
@@ -320,3 +332,23 @@ func main() {
 		return
 	}
 }
+
+// addGrpcConnectionReadyzCheck registers a readyz check named
+// "metricsservice-grpc-connection" that reports NotReady whenever the gRPC
+// connection to the KEDA metrics service is not in the Ready state. A replica
+// that cannot establish (or re-establish) the connection is then removed from
+// the APIService endpoints so requests are not routed to it.
+func addGrpcConnectionReadyzCheck(cmd *Adapter, grpcClient *metricsservice.GrpcClient) error {
+	server, err := cmd.Server()
+	if err != nil {
+		return err
+	}
+	return server.GenericAPIServer.AddReadyzChecks(
+		healthz.NamedCheck("metricsservice-grpc-connection", func(_ *http.Request) error {
+			if state := grpcClient.GetConnectionState(); state != connectivity.Ready {
+				return fmt.Errorf("gRPC connection to KEDA metrics service is not ready (state: %s)", state)
+			}
+			return nil
+		}),
+	)
+}
@@ -106,6 +106,26 @@ func NewGrpcClient(ctx context.Context, url, certDir, authority, confOptions str
 	return &grpcClient, nil
 }
 
+// GetConnectionState returns the current connectivity state of the underlying
+// gRPC connection to the KEDA metrics service.
+//
+// When the connection is Idle it also triggers a non-blocking reconnection
+// attempt (moving it towards Connecting) before returning. This matters for the
+// readiness probe: once a non-Ready state removes the replica from the
+// APIService endpoints, no RPCs flow through this client, so nothing else would
+// ever wake an Idle connection. gRPC parks a connection in Idle after
+// GRPC_CLIENT_IDLE_TIMEOUT_MS (30 minutes by default) without RPCs, so without
+// this nudge the replica could stay NotReady permanently. Connect() is
+// non-blocking and a no-op when the connection is not Idle, so it is safe to
+// call from a readiness probe.
+func (c *GrpcClient) GetConnectionState() connectivity.State {
+	state := c.connection.GetState()
+	if state == connectivity.Idle {
+		c.connection.Connect()
+	}
+	return state
+}
+
 func (c *GrpcClient) GetMetrics(ctx context.Context, scaledObjectName, scaledObjectNamespace, metricName string) (*external_metrics.ExternalMetricValueList, error) {
 	// Fail fast if the gRPC connection has been shut down, rather than
 	// waiting until the context timeout expires.
 
@@ -0,0 +1,77 @@
+/*
+Copyright 2026 The KEDA Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package metricsservice
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/connectivity"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+// TestGetConnectionState is a regression test for issue #8211: the metrics
+// adapter needs a way to observe the gRPC connection state so a readiness
+// probe can report NotReady when the connection to the KEDA metrics service
+// is down. GetConnectionState must reflect the underlying connection's state
+// without blocking.
+func TestGetConnectionState(t *testing.T) {
+	// A freshly created client (grpc.NewClient does not dial until first use)
+	// starts in the Idle state, which is not Ready. A readiness probe must be
+	// able to observe this so it does not report a not-yet-connected replica
+	// as Ready.
+	conn, err := grpc.NewClient("passthrough:///127.0.0.1:0",
+		grpc.WithTransportCredentials(insecure.NewCredentials()))
+	require.NoError(t, err)
+	defer conn.Close()
+
+	c := &GrpcClient{connection: conn}
+
+	// A connection that has never dialed is not Ready, so a readiness check
+	// built on this getter would correctly mark the replica NotReady.
+	require.NotEqual(t, connectivity.Ready, c.GetConnectionState())
+}
+
+// TestGetConnectionStateReconnectsWhenIdle guards against the failure mode
+// raised in review on PR #8226: once a non-Ready state removes the replica
+// from the APIService endpoints, no RPCs flow through the client, so an Idle
+// connection would never be woken and the replica could stay NotReady forever.
+// GetConnectionState must therefore trigger a non-blocking reconnect when it
+// observes an Idle connection, moving it off Idle so it can recover on its own.
+func TestGetConnectionStateReconnectsWhenIdle(t *testing.T) {
+	conn, err := grpc.NewClient("passthrough:///127.0.0.1:0",
+		grpc.WithTransportCredentials(insecure.NewCredentials()))
+	require.NoError(t, err)
+	defer conn.Close()
+
+	c := &GrpcClient{connection: conn}
+
+	// A fresh client is parked in Idle until something drives it to connect.
+	require.Equal(t, connectivity.Idle, conn.GetState())
+
+	// Calling the getter on an Idle connection must kick a reconnection
+	// attempt. The reported state is still the pre-nudge Idle, but the
+	// underlying connection then leaves Idle without any RPC being issued.
+	require.Equal(t, connectivity.Idle, c.GetConnectionState())
+
+	require.Eventually(t, func() bool {
+		return conn.GetState() != connectivity.Idle
+	}, 2*time.Second, 10*time.Millisecond,
+		"GetConnectionState should trigger a reconnect that moves the connection off Idle")
+}