A number of users have reported high CPU usage with v3.14.1. This seems to be coming from the lazy CredHub client construction, which was introduced to fix #2154 but seems to be unintentionally creating a CredHub client repeatedly rather than just once (on first use).

I think this is happening because this doesn't return a pointer: https://github.com/concourse/atc/blob/master/creds/credhub/manager.go#L98 ... and so the client is always assigned on a copy.

We should also make sure this is safe for concurrent use. I believe the current code won't be happy with -race once we make it a pointer. This may be a good time to use *sync.Once: https://golang.org/pkg/sync/#Once

• Concourse version: v3.14.1
• Deployment type (BOSH/Docker/binary): any that use CredHub
• Infrastructure/IaaS: any
• Browser (if applicable): n/a
• Did this used to work? yes