The mongos' cache invalidator job initializes its _previousCacheGeneration to one generated in memory by the mongos process' AuthorizationManager. Every time the invalidator job runs after that, however, it fetches the cache generation from the config servers. This means the first fetched cache generation will always be different from what _previousCacheGeneration was initialized with, so we'll always invalidate the cache once. The fix should be to initialize _previousCacheGeneration from the value on the config servers.