service annotations applied to both vault and vault-internal services

[raffaelespazzoli]

Describe the bug
the annotations in the service section are applied to both the vault and the vault-internal services and there is not way to distinguish between the two.
When deploying to OpenShift and the annotation is used to request a certificate, this causes a race condition because two services are trying to modify the same secret (containing the certificate)

To Reproduce
Steps to reproduce the behavior:

1. Install chart

with these options:

global:
  openshift: true
  tlsDisable: false
  
  ...
server:
  service: 
    annotations:
      service.beta.openshift.io/serving-cert-secret-name: vault-server-tls

try to connect to the vault instance via the vault service. 50% of the times the connection will fails because the cert cannot be validated.

Suggested solution: allow for a way to attribute annotations to individual services.
Also when did this change? As a workaround one could use the old version in which this used to work.

[eye0fra]

Hi @jasonodonnell and @tvoran,

Can you have a look?

Thanks a lot

[tvoran]

Hi @raffaelespazzoli, do you recall which old version used to work for you this way?

[raffaelespazzoli]

no I don't recall the old version, actually people have looked into this and said that the issue was there since the beginning, so probably I was just lucky.