Move synchronization to after read to reduce contention.

api/v1/ca.go

@@ -138,13 +138,6 @@ func MutateCaInjection(pod *corev1.Pod, config *Config) error {
 }
 
 func EnsureAssetsInNamespace(config *Config) error {
-	// it is possible that many mutations are requested in succession and this can lead to an "already exists"
-	// for the create operation. Thus, synchronize around the possible creation by only allowing one of this function
-	// to execute at any given time
-	mu := sync.Mutex{}
-	mu.Lock()
-	defer mu.Unlock()
-
 	// the goal is to ensure this exists already or we'll create it
 	qtapCaBundleExists := false
 
@@ -166,6 +159,13 @@ func EnsureAssetsInNamespace(config *Config) error {
 		return nil
 	}
 
+	// it is possible that many mutations are requested in succession and this can lead to an "already exists"
+	// for the create operation. Thus, synchronize around the possible creation by only allowing one of this function
+	// to execute at any given time
+	mu := sync.Mutex{}
+	mu.Lock()
+	defer mu.Unlock()
+
 	// we need to see if we have the qtap ca in the operator namespace
 	qpointRootCaConfigMap := &corev1.ConfigMap{}
 	if err := config.Client.Get(config.Ctx, client.ObjectKey{Namespace: config.OperatorNamespace, Name: QPOINT_ROOT_CA}, qpointRootCaConfigMap); err != nil {