Migrate CRI-O annotations to v2 format

[saschagrunert]

CRI-O migrated its annotations from v1 (io.kubernetes.cri-o.*) to v2 (*.crio.io) format. The old format is deprecated. This updates the builder pod annotations accordingly:

• io.kubernetes.cri-o.Devices -> devices.crio.io
• io.kubernetes.cri-o.userns-mode -> userns-mode.crio.io

Tracking: cri-o/cri-o#10194

Summary by CodeRabbit

• Bug Fixes
  • Updated build pod annotations to use current CRI-O annotation keys for FUSE device access and automatic user namespace mode.
  • Preserved existing builder behavior for clearing related io.openshift.builder annotations.
• Tests
  • Updated unit test expectations to match the new CRI-O annotation keys across privileged build scenarios.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c930e59f-7076-429f-adac-0ad398f1e6d9

📥 Commits

Reviewing files that changed from the base of the PR and between 469fdd7 and f6447dd.

📒 Files selected for processing (2)

• pkg/build/controller/strategy/util.go
• pkg/build/controller/strategy/util_test.go

🚧 Files skipped from review as they are similar to previous changes (2)

• pkg/build/controller/strategy/util_test.go
• pkg/build/controller/strategy/util.go

---

Walkthrough

Build pod setup now uses updated CRI-O annotation keys for FUSE devices and automatic user namespaces, with table-driven tests updated across privilege scenarios.

Changes

CRI-O annotation updates

Layer / File(s)	Summary
Update CRI-O annotation keys and expectations pkg/build/controller/strategy/util.go, pkg/build/controller/strategy/util_test.go	FUSE device and automatic user namespace setup use devices.crio.io and userns-mode.crio.io, with matching test expectations; io.openshift.builder clearing remains unchanged.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: ricardomaraschini, divyansh42

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: migrating CRI-O annotations from v1 to v2 format.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No dynamic or generated values appear in any test titles; the only subtest names are static BUILD_PRIVILEGED scenarios.
Test Structure And Quality	✅ Passed	The touched tests are unit-level table-driven tests, not Ginkgo; they don't create cluster resources or wait on conditions, and assertions already have messages.
Microshift Test Compatibility	✅ Passed	PASS: PR only changes unit-test expectations and pod annotation constants; no new Ginkgo e2e tests or MicroShift-incompatible APIs/features were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the touched test file is standard unit tests only, with no SNO-relevant multi-node assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	Only CRI-O annotation keys changed in pod metadata and tests; no scheduling, affinity, nodeSelector, replicas, or topology logic was modified.
Ote Binary Stdout Contract	✅ Passed	The PR only changes CRI-O annotation keys in util.go and matching tests; no stdout writes or process-level hooks appear in the modified files.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only unit-test files changed; no Ginkgo e2e tests, IPv4 literals, host/IP parsing, or external connectivity found.
No-Weak-Crypto	✅ Passed	Changed files only update CRI-O annotation keys; no crypto imports, weak algorithms, or secret comparisons appear in the touched code.
Container-Privileges	✅ Passed	Diff only renames CRI-O annotations; no privileged, hostPID/Network/IPC, SYS_ADMIN, root, or allowPrivilegeEscalation settings were added or changed.
No-Sensitive-Data-In-Logs	✅ Passed	PR only changes CRI-O annotation keys and tests; no new logging or sensitive-data exposure was introduced.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign bparees for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• pkg/build/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/build/controller/strategy/util_test.go`:
- Around line 814-851: The BUILD_PRIVILEGED test cases in the relevant table
must also assert that deprecated CRI-O annotations io.kubernetes.cri-o.Devices
and io.kubernetes.cri-o.userns-mode are absent. Add both keys to each applicable
noAnnotations expectation, or add a shared postcondition after the annotation
assertions, while preserving the existing checks for the current annotation
keys.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 6dfc6dad-dbc8-42b9-af96-849075b27b3a

📥 Commits

Reviewing files that changed from the base of the PR and between 5631cf4 and 469fdd7.

📒 Files selected for processing (2)

• pkg/build/controller/strategy/util.go
• pkg/build/controller/strategy/util_test.go

[saschagrunert]

/retest

[saschagrunert]

/retest

[openshift-ci]

@saschagrunert: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-hypershift-conformance	f6447dd	link	true	/test e2e-hypershift-conformance

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.