I don't think it is the compatibility, need to really see your configuration to be sure. But most likely, you block something wrongly. If you use the default network policy api networking.k8s.io/v1 notice that it only allows what is defined.
The ConfigMap and Annotation configuration have different purposes.
As per nginx-configuration/configmap/#ssl-protocols:
Sets the SSL protocols to use. The default is: TLSv1.2 TLSv1.3
Context: http, server
i.e., enable the specified protocols to your Nginx Controller.
client --ssl-protocols-> controller --> ...
If my assumption is correct that's related to having a loadbalancer that wasn't correctly deleted.
Which could be resulted by redeploying a service (of type: load balancer) in a short time before Azure cleans up the previously associated loadbalancer resource.
To my knowledge, that could be fixed with the rolling of Kubernetes 1.17 and the Loadbalancer ...
The following setup works for me. When using the subPath in volumeMounts, the permission issue is automatically addressed, as the user postgres owns the folder corresponding to the subPath.
# need a subpath as postgres wants an empty folder (the mounted folder `/var/lib/...