There doesn’t seem to be support for the

Application Gateway Ingress Controller

yet. Does anyone have a workaround integrated in their Pulumi setup? https://docs.microsoft.com/en-us/azure/application-gateway/ingress-controller-overview

Do you mean https://github.com/pulumi/pulumi-azure/issues/655 ? Or what would having support for AGIC require?

I guess so. But this feature isn’t yet available in the upstream TF provider: https://github.com/terraform-providers/terraform-provider-azurerm/issues/7384

Is it managed via ARM or is it external to it?

According the MS document above, AGIC is best enabled as an add-on feature to AKS first (instead of a Helm deployment). It listens for specific annotated Ingress resources in the cluster and then speaks to the ARM api to create the proper Application Gateway routes. These routes should then be ignored by Pulumi as was reported by the Pulumi ticket you posted.

enabled as an add-on feature to AKS first

How does one do that? (without Pulumi or Terraform)

Linked from the first webpage is this page: https://docs.microsoft.com/en-us/azure/application-gateway/tutorial-ingress-controller-add-on-new#prerequisites Via Azure CLI, one currently must trigger:

az feature register --name AKS-IngressApplicationGatewayAddon --namespace Microsoft.ContainerService