Run modules that rely on Services after AntreaProxy is ready

If kube-proxy is not running, AntreaProxy is responsible for proxying
the access to Services. For components that rely on Services, they
should run after AntreaProxy is ready.

Accessing Service IPs before they are proxied leads to weird behaviors
on Windows platform.

Signed-off-by: Quan Tian <qtian@vmware.com>

cmd/antrea-agent/agent.go

@@ -641,7 +641,6 @@ func run(o *Options) error {
 
 	go antreaClientProvider.Run(ctx)
 
-	go networkPolicyController.Run(stopCh)
 	// Initialize the NPL agent.
 	if enableNodePortLocal {
 		nplController, err := npl.InitializeNPLAgent(
@@ -711,10 +710,6 @@ func run(o *Options) error {
 		go memberlistCluster.Run(stopCh)
 	}
 
-	if o.enableEgress {
-		go egressController.Run(stopCh)
-	}
-
 	if features.DefaultFeatureGate.Enabled(features.ServiceExternalIP) {
 		go externalIPController.Run(stopCh)
 	}
@@ -740,6 +735,14 @@ func run(o *Options) error {
 			klog.InfoS("AntreaProxy is ready")
 		}
 	}
+
+	// NetworkPolicyController and EgressController accesses the "antrea" Service via its ClusterIP.
+	// Run them after AntreaProxy is ready.
+	go networkPolicyController.Run(stopCh)
+	if o.enableEgress {
+		go egressController.Run(stopCh)
+	}
+
 	var mcastController *multicast.Controller
 	if multicastEnabled {
 		multicastSocket, err := multicast.CreateMulticastSocket()