Now checking for at least 2 healthy rdonly instances in workers.

That way we don't consume the last rdonyl instance and possibly
cause an outage.

@aaijazi @enisoc