创建Ingress时因策略限制，AKS无法修改AGIC求助

已完成基于Azure CNI的AKS与AGIC部署，尝试通过以下配置部署NGINX验证环境：

Ingress配置 #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-ingress
  annotations:
    kubernetes.io/ingress.class: azure/application-gateway
    kubernetes.io/ingress.allow-http: "false"
    appgw.ingress.kubernetes.io/use-private-ip: "false" 
    appgw.ingress.kubernetes.io/override-frontend-port: "443"
spec:
  tls:
    - hosts:
        - my.domain.com
      secretName: aks-ingress-tls
  rules:
    - host: my.domain.com
      http:
          paths:
          - path: /
            pathType: Prefix 
            backend:
              service:
                name: nginx-service
                port:
                  number: 80

Deployment配置 #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      component: nginx
  template:
    metadata:
      labels:
        component: nginx
    spec:
      containers:
        - name: nginx
          image: nginx
          ports:
            - containerPort: 80

Service配置 #

apiVersion: v1
kind: Service
metadata:
  name: nginx-service
spec:
  type: ClusterIP
  selector:
    component: nginx
  ports:
    - port: 80
      protocol: TCP

执行部署命令无报错，输出如下：

> k apply -f nginx-test.yml
deployment.apps/nginx-deployment created
service/nginx-service created
ingress.networking.k8s.io/nginx-ingress created

但查看应用网关活动日志时，同步配置出现错误：

• Operation name: Create or Update Application Gateway
• Error code: RequestDisallowedByPolicy
• Message: Resource 'my-application-gateway' was disallowed by policy.

[
  {
    "policyAssignment": {
      "name": "Encryption In Transit",
      "id": "/providers/Microsoft.Management/managementGroups/***/providers/Microsoft.Authorization/policyAssignments/EncryptionInTransit"
    },
    "policyDefinition": {
      "name": "HTTPS protocol only on Application Gateway listeners",
      "id": "/providers/microsoft.management/managementgroups/***/providers/Microsoft.Authorization/policyDefinitions/HttpsOnly_App_Gateways"
    },
    "policySetDefinition": {
      "name": "Encryption In Transit",
      "id": "/providers/Microsoft.Management/managementgroups/***/providers/Microsoft.Authorization/policySetDefinitions/EncryptionInTransit"
    }
  }
]

组织有强制TLS的策略，但已在Ingress中配置仅使用HTTPS并部署了证书，不清楚问题所在，求指导排查方向。

内容的提问来源于stack exchange，提问作者TacticalBacon