node initialization must come after primary ENI's security groups are…

… synced to cache

pkg/ipamd/ipamd.go

@@ -439,14 +439,8 @@ func New(rawK8SClient client.Client, cachedK8SClient client.Client) (*IPAMContex
 	checkpointer := datastore.NewJSONFile(dsBackingStorePath())
 	c.dataStore = datastore.NewDataStore(log, checkpointer, c.enablePrefixDelegation)
 
-	err = c.nodeInit()
-	if err != nil {
-		return nil, err
-	}
-
-	mac := c.awsClient.GetPrimaryENImac()
-
 	// Retrieve security groups
+	mac := c.awsClient.GetPrimaryENImac()
 	if c.enableIPv4 && !c.disableENIProvisioning {
 		err = c.awsClient.RefreshSGIDs(mac)
 		if err != nil {
@@ -458,6 +452,11 @@ func New(rawK8SClient client.Client, cachedK8SClient client.Client) (*IPAMContex
 		go wait.Forever(func() { _ = c.awsClient.RefreshSGIDs(mac) }, 30*time.Second)
 	}
 
+	err = c.nodeInit()
+	if err != nil {
+		return nil, err
+	}
+
 	return c, nil
 }