#chainhead_header is expected momenterarily to be ahead. If its considerably ahead (e.g more than 5 blocks), then the node is definitely out of sync. 
 template: geth_chainhead_diff_between_header_block
       on: geth.chainhead
    class: Workload
     type: ethereum_node
component: geth
    every: 10s
     calc: $chain_head_block -  $chain_head_header
    units: blocks
     warn: $this != 0
     crit: $this > 5
    delay: down 1m multiplier 1.5 max 1h