如何通过Terraform将Basic SKU负载均衡器与AKS集群集成？

使用默认配置通过azurerm_kubernetes_cluster创建最小化AKS集群时，会自动生成load_balancer_sku = standard的负载均衡器及load_balancer_profile块，对应的负载均衡器和公网IP可在Azure门户资源列表中查看。

但当设置load_balancer_sku = basic时，Terraform状态中无相关资源记录（仅标签），也未生成load_balancer_profile块，Azure门户中也未创建任何对应资源。未找到关于如何正确创建与Basic SKU azurerm_lb、Basic SKU azurerm_public_ip配合的AKS集群的完整资料，若有相关权威资源也请提供。

拼凑现有资料编写了以下Terraform代码：

# azurerm_kubernetes_cluster
resource "azurerm_kubernetes_cluster" "k8s" {
  location            = azurerm_resource_group.rg.location
  name                = var.name
  resource_group_name = azurerm_resource_group.rg.name
  node_resource_group = "${local.node_resource_group_name}"
  dns_prefix          = "${local.dns_prefix}"

  identity {
    type = "SystemAssigned"
  }

  default_node_pool {
    name       = "agentpool"
    vm_size    = "Standard_B2s"
    node_count = 1
  }

  network_profile {
    network_plugin = "kubenet"
    load_balancer_sku = "basic"
  }
}

# azurerm_public_ip
resource "azurerm_public_ip" "k8s_lb_ip" {
  name                = "PublicIPForLB"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_kubernetes_cluster.k8s.node_resource_group # 疑问：这真的必须吗？我不希望IP在节点资源组中，因为节点池更新时它会被销毁！
  allocation_method   = "Static"
}

# azurerm_lb
resource "azurerm_lb" "k8s_lb" {
  name                = "BasicLoadBalancer"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name

  frontend_ip_configuration {
    name                 = "PublicIPAddress"
    public_ip_address_id = azurerm_public_ip.k8s_lb_ip.id
  }
}

# azurerm_role_assignment
resource "azurerm_role_assignment" "lb_ip_aks_integration" {
  description = "允许Basic SKU负载均衡器和公网IP与`load_balancer_sku = basic`的AKS集群集成"
  principal_id                     = azurerm_kubernetes_cluster.k8s.kubelet_identity[0].object_id
  role_definition_name             = "Network Contributor"
  scope                            = azurerm_public_ip.k8s_lb_ip.id
  skip_service_principal_aad_check = true
}

其中角色分配部分参考了官方文档，但文档暗示azurerm_public_ip.resource_group_name需设置为集群的节点资源组，这并不理想，我希望公网IP位于自定义资源组中，避免随自动管理的节点资源组被销毁。

即使配置了上述资源，部署如下Nginx Ingress Controller时：

resource "helm_release" "nginx_ingress" {
  name = "nginx-ingress-controller"

  repository = "https://charts.bitnami.com/bitnami"
  chart      = "nginx-ingress-controller"

  set {
    name  = "controller.service.externalTrafficPolicy"
    value = "Local"
  }
  set {
      name        = "controller.service.loadBalancerIP"
      value = var.public_ip # azurerm_public_ip.ip_address
   }
}

系统仍自动创建了与手动配置无关的独立公网IP和负载均衡器，未使用预先部署的资源。

请问我遗漏了哪些关键配置？如何让手动部署的Basic SKU负载均衡器、公网IP与AKS集群正确协同工作？

内容的提问来源于stack exchange，提问作者user658182