Migrate CRI-O annotations to v2 format

[saschagrunert]

What this PR does / why we need it:

CRI-O migrated its annotations from v1 (io.kubernetes.cri-o.*) to v2 (*.crio.io). This updates the allowed_annotations in docs to use the new format.

Which issue(s) this PR fixes:

Ref cri-o/cri-o#10194

Special notes for your reviewer:

The old v1 annotations are deprecated and will be removed in a future CRI-O release.

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[coderabbitai]

📝 Walkthrough

Walkthrough

The CRI-O runtime recipe documentation updates the allowed_annotations entries in both the crun and runc high-performance MachineConfig examples. Deprecated io.kubernetes.cri-o.* identifiers are replaced with devices.crio.io and link-logs.crio.io.

Suggested reviewers: cblecker, csrwng

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The recipe docs update the CRI-O annotations to v2 as required by #10194's HyperShift follow-up.
Out of Scope Changes check	✅ Passed	The changes stay within the documented HyperShift recipe update and add no unrelated scope.
Stable And Deterministic Test Names	✅ Passed	Only docs markdown changed; no test files or Ginkgo titles were added or modified.
Test Structure And Quality	✅ Passed	Docs-only PR; no Ginkgo tests were added or modified, so the test-structure checklist is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	Docs-only change updates CRI-O annotation names in recipe snippets; no manifests, code, or topology-sensitive scheduling constraints were introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only documentation files changed; no Ginkgo e2e tests or network-dependent code were added, so the IPv6/disconnected check is not applicable.
No-Weak-Crypto	✅ Passed	PASS: The patch only updates doc strings and generated docs for CRI-O annotations; the diff contains no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	PR only updates CRI-O annotation names in docs snippets; no privileged, hostPID/hostNetwork/hostIPC, SYS_ADMIN, root, or allowPrivilegeEscalation=true settings were introduced.
No-Sensitive-Data-In-Logs	✅ Passed	Docs-only change swaps CRI-O annotation names; no logging code or sensitive data (tokens, passwords, PII, hostnames) was added.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: updating CRI-O annotations from v1 to v2 format.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: saschagrunert
Once this PR has been reviewed and has the lgtm label, please assign bryan-cox for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@saschagrunert: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.