diff --git a/pkg/apis/minio.min.io/v2/zz_generated.deepcopy.go b/pkg/apis/minio.min.io/v2/zz_generated.deepcopy.go
index f853ce646ea..8ae08475b84 100644
--- a/pkg/apis/minio.min.io/v2/zz_generated.deepcopy.go
+++ b/pkg/apis/minio.min.io/v2/zz_generated.deepcopy.go
@@ -162,6 +162,13 @@ func (in *KESConfig) DeepCopyInto(out *KESConfig) {
 		*out = new(v1.Affinity)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.TopologySpreadConstraints != nil {
+		in, out := &in.TopologySpreadConstraints, &out.TopologySpreadConstraints
+		*out = make([]v1.TopologySpreadConstraint, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
 	if in.SecurityContext != nil {
 		in, out := &in.SecurityContext, &out.SecurityContext
 		*out = new(v1.PodSecurityContext)
@@ -219,6 +226,13 @@ func (in *LogConfig) DeepCopyInto(out *LogConfig) {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
+	if in.TopologySpreadConstraints != nil {
+		in, out := &in.TopologySpreadConstraints, &out.TopologySpreadConstraints
+		*out = make([]v1.TopologySpreadConstraint, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
 	if in.Annotations != nil {
 		in, out := &in.Annotations, &out.Annotations
 		*out = make(map[string]string, len(*in))
@@ -289,6 +303,13 @@ func (in *LogDbConfig) DeepCopyInto(out *LogDbConfig) {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
+	if in.TopologySpreadConstraints != nil {
+		in, out := &in.TopologySpreadConstraints, &out.TopologySpreadConstraints
+		*out = make([]v1.TopologySpreadConstraint, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
 	if in.Annotations != nil {
 		in, out := &in.Annotations, &out.Annotations
 		*out = make(map[string]string, len(*in))
@@ -365,6 +386,13 @@ func (in *Pool) DeepCopyInto(out *Pool) {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
+	if in.TopologySpreadConstraints != nil {
+		in, out := &in.TopologySpreadConstraints, &out.TopologySpreadConstraints
+		*out = make([]v1.TopologySpreadConstraint, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
 	if in.SecurityContext != nil {
 		in, out := &in.SecurityContext, &out.SecurityContext
 		*out = new(v1.PodSecurityContext)
@@ -452,6 +480,13 @@ func (in *PrometheusConfig) DeepCopyInto(out *PrometheusConfig) {
 		*out = new(v1.Affinity)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.TopologySpreadConstraints != nil {
+		in, out := &in.TopologySpreadConstraints, &out.TopologySpreadConstraints
+		*out = make([]v1.TopologySpreadConstraint, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
 	in.Resources.DeepCopyInto(&out.Resources)
 	if in.SecurityContext != nil {
 		in, out := &in.SecurityContext, &out.SecurityContext
@@ -731,6 +766,16 @@ func (in *TenantSpec) DeepCopyInto(out *TenantSpec) {
 		*out = new(bool)
 		**out = **in
 	}
+	if in.Liveness != nil {
+		in, out := &in.Liveness, &out.Liveness
+		*out = new(v1.Probe)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Readiness != nil {
+		in, out := &in.Readiness, &out.Readiness
+		*out = new(v1.Probe)
+		(*in).DeepCopyInto(*out)
+	}
 	if in.S3 != nil {
 		in, out := &in.S3, &out.S3
 		*out = new(S3Features)
diff --git a/pkg/controller/cluster/main-controller.go b/pkg/controller/cluster/main-controller.go
index 652eddbe51b..19f89ec2933 100644
--- a/pkg/controller/cluster/main-controller.go
+++ b/pkg/controller/cluster/main-controller.go
@@ -346,42 +346,41 @@ func getSecretForTenant(tenant *miniov2.Tenant, accessKey, secretKey string) *v1
 // is closed, at which point it will shutdown the workqueue and wait for
 // workers to finish processing their current work items.
 func (c *Controller) Start(threadiness int, stopCh <-chan struct{}) error {
-	// we need to make sure the API is ready before starting operator
-	apiWillStart := make(chan interface{})
-
-	go func() {
-
-		// Request kubernetes version from Kube ApiServer
-		c.getKubeAPIServerVersion()
-
-		if isOperatorTLS() {
-			publicCertPath, publicKeyPath := c.generateTLSCert()
-			klog.Infof("Starting HTTPS api server")
-			close(apiWillStart)
-			// use those certificates to configure the web server
-			if err := c.ws.ListenAndServeTLS(publicCertPath, publicKeyPath); err != http.ErrServerClosed {
-				klog.Infof("HTTPS server ListenAndServeTLS failed: %v", err)
-				panic(err)
-			}
-		} else {
-			klog.Infof("Starting HTTP api server")
-			close(apiWillStart)
-			// start server without TLS
-			if err := c.ws.ListenAndServe(); err != http.ErrServerClosed {
-				klog.Infof("HTTP server ListenAndServe failed: %v", err)
-				panic(err)
+	// Start the API and the Controller, but only if this pod is the leader
+	run := func(ctx context.Context) {
+		// we need to make sure the API is ready before starting operator
+		apiWillStart := make(chan interface{})
+
+		go func() {
+
+			// Request kubernetes version from Kube ApiServer
+			c.getKubeAPIServerVersion()
+
+			if isOperatorTLS() {
+				publicCertPath, publicKeyPath := c.generateTLSCert()
+				klog.Infof("Starting HTTPS API server")
+				close(apiWillStart)
+				// use those certificates to configure the web server
+				if err := c.ws.ListenAndServeTLS(publicCertPath, publicKeyPath); err != http.ErrServerClosed {
+					klog.Infof("HTTPS server ListenAndServeTLS failed: %v", err)
+					panic(err)
+				}
+			} else {
+				klog.Infof("Starting HTTP API server")
+				close(apiWillStart)
+				// start server without TLS
+				if err := c.ws.ListenAndServe(); err != http.ErrServerClosed {
+					klog.Infof("HTTP server ListenAndServe failed: %v", err)
+					panic(err)
+				}
 			}
-		}
-	}()
-
-	klog.Info("Waiting for API to start")
-	<-apiWillStart
+		}()
 
-	// Start the informer factories to begin populating the informer caches
-	klog.Info("Starting Tenant controller")
+		klog.Info("Waiting for API to start")
+		<-apiWillStart
 
-	run := func(ctx context.Context) {
-		klog.Info("Controller loop...")
+		// Start the informer factories to begin populating the informer caches
+		klog.Info("Starting Tenant controller")
 
 		// Wait for the caches to be synced before starting workers
 		klog.Info("Waiting for informer caches to sync")
@@ -451,8 +450,7 @@ func (c *Controller) Start(threadiness int, stopCh <-chan struct{}) error {
 		RetryPeriod:     5 * time.Second,
 		Callbacks: leaderelection.LeaderCallbacks{
 			OnStartedLeading: func(ctx context.Context) {
-				// we're notified when we start - this is where you would
-				// usually put your code
+				// start the controller + API code
 				run(ctx)
 			},
 			OnStoppedLeading: func() {