The available_controller creates short-lived clients to sync remote APIService objects. These clients are constructed with HTTP transports that cannot be cached by client-go (because client-go won't know whether the TLS configs have dynamic functions or not), which may spam idle connections. A local cache works because we know all the configs share the same dialer function, and can only vary on the dynamic cert/key.