backport of commit 9566221 (#15982)

Co-authored-by: Theron Voran <tvoran@users.noreply.github.com>

website/content/docs/platform/k8s/injector/annotations.mdx

@@ -27,7 +27,7 @@ them, optional commands to run, etc.
   Agent configuration file and templates can be found.
 
 - `vault.hashicorp.com/agent-image` - name of the Vault docker image to use. This
-  value overrides the default image configured in the controller and is usually
+  value overrides the default image configured in the injector and is usually
   not needed. Defaults to `vault:1.7.2`.
 
 - `vault.hashicorp.com/agent-init-first` - configures the pod to run the Vault Agent
@@ -224,9 +224,10 @@ etc.
 - `vault.hashicorp.com/role` - configures the Vault role used by the Vault Agent
   auto-auth method. Required when `vault.hashicorp.com/agent-configmap` is not set.
 
-- `vault.hashicorp.com/service` - name of the Vault service to use. This value
-  overrides the default service configured in the controller and is usually not
-  needed.
+- `vault.hashicorp.com/service` - configures the Vault address for the injected
+  Vault Agent to use. This value overrides the default Vault address configured
+  in the injector, and may either be the address of a Vault service within the
+  same Kubernetes cluster as the injector, or an external Vault URL.
 
 - `vault.hashicorp.com/tls-secret` - name of the Kubernetes secret containing TLS
   Client and CA certificates and keys. This is mounted to `/vault/tls`.