Move service annotations out of Ingress blocks

app/_src/kubernetes-ingress-controller/guides/services/grpc.md

@@ -71,6 +71,19 @@ service/grpcbin created
 
 ### gRPC over HTTPS
 
+All services are assumed to be either HTTP or HTTPS by default. We need to update the service to specify gRPC as the protocol by adding a `konghq.com/protocol` annotation.
+
+The annotation `grpcs` informs Kong that this service is a gRPC (with TLS) service and not a HTTP service.
+
+```bash
+kubectl annotate service grpcbin 'konghq.com/protocol=grpcs'
+```
+
+The results should look like this:
+```text
+service/grpcbin annotated
+```
+
 #### Create a certificate
 
 {% include /md/kic/add-certificate.md hostname='example.com' kong_version=page.kong_version cert_required=true %}
@@ -136,18 +149,7 @@ grpcroute.gateway.networking.k8s.io/grpcbin created
 {% endnavtab %}
 {% navtab Ingress %}
 
-All routes and services are assumed to be either HTTP or HTTPS by default. We need to update the service to specify gRPC as the protocol by adding a `konghq.com/protocol` annotation.
-
-The annotation `grpcs` informs Kong that this service is a gRPC (with TLS) service and not a HTTP service.
-
-```bash
-kubectl annotate service grpcbin 'konghq.com/protocol=grpcs'
-```
-
-The results should look like this:
-```text
-service/grpcbin annotated
-```
+All routes and services are assumed to be either HTTP or HTTPS by default. We need to update the service to specify gRPC as the protocol by adding a `konghq.com/protocols` annotation.
 
 This annotation informs Kong that this Ingress routes gRPC (with TLS) traffic and not a HTTP traffic.
 
@@ -196,6 +198,17 @@ The results should look like this:
 
 ### gRPC over HTTP
 
+All services are assumed to be either HTTP or HTTPS by default. We need to update the service to specify gRPC as the protocol by adding a `konghq.com/protocol` annotation.
+
+The annotation `grpc` informs Kong that this service is a gRPC (with TLS) service and not a HTTP service.
+
+```bash
+kubectl annotate service grpcbin 'konghq.com/protocol=grpc'
+```
+
+Now that the test application is running, you can create GRPC routing configuration that
+proxies traffic to the application:
+
 For gRPC over HTTP (plaintext without TLS), configuration of Kong Gateway needs to be adjusted. By default Kong Gateway
 accepts HTTP/2 traffic with TLS on port `443`. And HTTP/1.1 traffic on port `80`. To accept HTTP/2 (which is required by gRPC standard)
 traffic without TLS on port `80`, the configuration has to be adjusted.
@@ -210,9 +223,6 @@ are handled transparently). You may configure an alternative HTTP/2 port (e.g. `
 
 #### Route gRPC traffic
 
-Now that the test application is running, you can create GRPC routing configuration that
-proxies traffic to the application:
-
 {% navtabs api %}
 {% navtab Gateway API %}
 {% if_version gte:3.1.x %}
@@ -246,21 +256,6 @@ grpcroute.gateway.networking.k8s.io/grpcbin created
 {% endnavtab %}
 {% navtab Ingress %}
 
-All routes and services are assumed to be either HTTP or HTTPS by default. We need to update the service to specify gRPC as the protocol by adding a `konghq.com/protocol` annotation.
-
-The annotation `grpc` informs Kong that this service is a plaintext gRPC (without TLS) service and not a HTTP service.
-
-```bash
-kubectl annotate service grpcbin 'konghq.com/protocol=grpc'
-```
-
-The results should look like this:
-```text
-service/grpcbin annotated
-```
-
-This annotation informs Kong that this Ingress routes plaintext gRPC (without TLS) traffic and not a HTTP traffic.
-
 ```bash
 echo "apiVersion: networking.k8s.io/v1
 kind: Ingress