}
	// test the handlers
	testHandler(hcs, nsn1, http.StatusServiceUnavailable, 0, t)
	testHandler(hcs, nsn2, http.StatusServiceUnavailable, 0, t)
	testHandler(hcs, nsn3, http.StatusServiceUnavailable, 0, t)

	// sync endpoints
	hcs.SyncEndpoints(map[types.NamespacedName]int{
		nsn1: 9,
		nsn2: 3,
		nsn3: 7,
	})

	ctx := newContext(r, w, "ClusterCheckHandler")

	objLayer := newObjectLayerFn()
	if objLayer == nil {
		w.Header().Set(xhttp.MinIOServerStatus, unavailable)
		writeResponse(w, http.StatusServiceUnavailable, nil, mimeNone)
		return
	}

	ctx, cancel := context.WithTimeout(ctx, globalAPIConfig.getClusterDeadline())
	defer cancel()

	opts := HealthOptions{
		Maintenance:    r.Form.Get("maintenance") == "true",

	return func(w http.ResponseWriter, _ *http.Request) {
		if !installReady.Load().(bool) || !watchReady.Load().(bool) {
			http.Error(w, http.StatusText(http.StatusServiceUnavailable), http.StatusServiceUnavailable)
			return
		}
		w.WriteHeader(http.StatusOK)
	}

	server := httptest.NewServer(router)
	defer server.Close()

	makeReq(t, server.URL, constants.LivenessEndpoint, http.StatusOK)
	makeReq(t, server.URL, constants.ReadinessEndpoint, http.StatusServiceUnavailable)

	installReady.Store(true)
	watchReady.Store(true)
	assert.Equal(t, installReady.Load(), true)
	assert.Equal(t, watchReady.Load(), true)

	makeReq(t, server.URL, constants.LivenessEndpoint, http.StatusOK)

				{
					name:            "missing",
					statusCode:      http.StatusServiceUnavailable,
					credentialToUse: credNameMissing,
					useGateway:      false,
				},
				{
					name:            "no client certs",
					statusCode:      http.StatusServiceUnavailable,
					credentialToUse: strings.TrimSuffix(simpleCredName, "-cacert"),
					useGateway:      false,
				},

	StatusInternalServerError           = 500 // RFC 9110, 15.6.1
	StatusNotImplemented                = 501 // RFC 9110, 15.6.2
	StatusBadGateway                    = 502 // RFC 9110, 15.6.3
	StatusServiceUnavailable            = 503 // RFC 9110, 15.6.4
	StatusGatewayTimeout                = 504 // RFC 9110, 15.6.5
	StatusHTTPVersionNotSupported       = 505 // RFC 9110, 15.6.6
	StatusVariantAlsoNegotiates         = 506 // RFC 2295, 8.1

		Description:    "STS API not initialized, please try again.",
		HTTPStatusCode: http.StatusServiceUnavailable,
	},
	ErrSTSIAMNotInitialized: {
		Code:           "STSIAMNotInitialized",
		Description:    "STS IAM not initialized, please try again.",
		HTTPStatusCode: http.StatusServiceUnavailable,
	},
	ErrSTSUpstreamError: {
		Code:           "InternalError",

			handlerInvoked:          0,
			signalAttachedToContext: false,
			wgInvokedExpected:       1,
			retryAfterExpected:      true,
			statusCodeExpected:      http.StatusServiceUnavailable,
		},
		{
			name:                    "request is a WATCH, wait group is accepting",
			requestInfo:             &apirequest.RequestInfo{Verb: "watch"},
			wg:                      &fakeRequestWaitGroup{},

		Description:    "Resource requested is unreadable, please reduce your request rate",
		HTTPStatusCode: http.StatusServiceUnavailable,
	},
	ErrSlowDownWrite: {
		Code:           "SlowDownWrite",
		Description:    "Resource requested is unwritable, please reduce your request rate",
		HTTPStatusCode: http.StatusServiceUnavailable,
	},
	ErrMaxVersionsExceeded: {
		Code:           "MaxVersionsExceeded",

					credentialToUse: credNameGeneric,
					from:            apps.Ns1.B,
					drSelector:      "b",
					expectedResponse: ingressutil.ExpectedResponse{
						StatusCode: http.StatusServiceUnavailable,
					},
				},
				// Mutual TLS origination using an invalid client certificate
				// This will result in a 503 with the UH flag because the cluster will
				// stay warming until a valid secret is sent.