Migrate CRI-O annotations to v2 format

[saschagrunert]

CRI-O migrated its annotations from v1 (io.kubernetes.cri-o.*) to v2 (*.crio.io) in December 2025. The old format is deprecated.

Replacements:

• io.kubernetes.cri-o.Devices -> devices.crio.io
• io.kubernetes.cri-o.LinkLogs -> link-logs.crio.io
• io.kubernetes.cri-o.userns-mode -> userns-mode.crio.io

Tracking: cri-o/cri-o#10194

Summary by CodeRabbit

• Bug Fixes

  • Updated pod annotations to use the current CRI-O formats for device access, log linking, and user namespace configuration.
  • Preserved existing behavior and values for FUSE access, logging volume links, and automatic user namespace mode.

• Tests

  • Updated end-to-end test data and validation references to match the current annotation formats.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: bcf3d29e-d07a-4394-bd63-dd066a3d4823

📥 Commits

Reviewing files that changed from the base of the PR and between 621e171 and 9d62a7b.

📒 Files selected for processing (8)

• test/extended/node/nested_container.go
• test/extended/node/node_e2e/node.go
• test/extended/testdata/bindata.go
• test/extended/testdata/node/node_e2e/pod-dev-fuse.yaml
• test/extended/util/compat_otp/testdata/bindata.go
• test/extended/util/compat_otp/testdata/node/pod-dev-fuse.yaml
• test/extended/util/compat_otp/testdata/node/pod-loglink.yaml
• test/extended/util/compat_otp/testdata/node/pod-user-namespace.yaml

---

Walkthrough

The extended node and compatibility tests replace legacy CRI-O annotation keys with devices.crio.io, link-logs.crio.io, and userns-mode.crio.io while preserving existing annotation values.

Changes

CRI-O annotation migration

Layer / File(s)	Summary
Node device annotation updates test/extended/node/..., test/extended/testdata/...	Node pod specifications and embedded test data use devices.crio.io; the related skip-condition comment references crun’s allowed_annotations.
Compatibility annotation template updates test/extended/util/compat_otp/testdata/...	Compatibility fixtures update device, log-link, and user namespace annotation keys while retaining their existing values.

Estimated code review effort: 2 (Simple) | ~5 minutes

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Microshift Test Compatibility	⚠️ Warning	test/extended/node/nested_container.go still uses new-build and openshift-image-registry, and has no MicroShift guard.	Add a MicroShift skip/guard for this test, or refactor it to avoid BuildConfig/build and openshift-image-registry dependencies.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: migrating CRI-O annotations from v1 to v2 format.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR only updates annotation keys/comments; the Ginkgo titles in changed Go files are static and deterministic, with no dynamic suffixes or runtime values.
Test Structure And Quality	✅ Passed	PASS: The PR only updates annotation keys/comments and fixtures; the touched Ginkgo tests already use cleanup and bounded waits, with no new structure issues.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only annotation/testdata/comment updates; no new Ginkgo tests or multi-node/HA assumptions were added, and the existing test just uses one worker node.
Topology-Aware Scheduling Compatibility	✅ Passed	Changes only migrate CRI-O annotation keys in test pods/comments; no node selectors, affinity, spreads, replicas, or PDBs were added.
Ote Binary Stdout Contract	✅ Passed	PASS: The patch only updates CRI-O annotation strings and a skip comment in test data; no main/TestMain/init stdout writes or fmt/klog stdout use were added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new e2e test logic was added; changes only rename CRI-O annotations/templates, with no IPv4 assumptions or new external connectivity introduced.
No-Weak-Crypto	✅ Passed	The PR only renames CRI-O annotation keys in test YAML/fixtures; the changed windows show no MD5/SHA1/DES/RC4/3DES/Blowfish, ECB, or secret comparison code.
Container-Privileges	✅ Passed	Touched manifests keep privileged flags off; updated pods use runAsNonRoot and allowPrivilegeEscalation:false, with no hostPID/hostNetwork/hostIPC/SYS_ADMIN.
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The PR only renames CRI-O annotation keys and updates a skip comment; I found no new logging or sensitive data exposure in the changed files.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ast-grep (0.44.1)

test/extended/util/compat_otp/testdata/bindata.go

ast-grep timed out on this file

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: saschagrunert
Once this PR has been reviewed and has the lgtm label, please assign stbenjam for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[saschagrunert]

/retest

[saschagrunert]

/retest

[openshift-ci]

@saschagrunert: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/verify	9d62a7b	link	true	/test verify

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.