Document (accidentally private) annotation `api-approved.kubernetes.io`

This is a Bug Report

Problem: Annotation api-approved.kubernetes.io is used, but not documented. https://github.com/kubernetes/enhancements/tree/master/keps/sig-api-machinery/2337-k8s.io-group-protection mentions a private annotation that you must use if you're developing a custom API extension that uses a Kubernetes-reserved API group.

Proposed Solution: Document the private annotation api-approved.kubernetes.io and when you might need to use it.

As I understand it:

• We should mention this annotation specially within https://kubernetes.io/docs/reference/labels-annotations-taints/ because this is a private annotation (doesn't contain / - see https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/#syntax-and-character-set) and is not part of the Kubernetes annotation namespace.
  • Explain that it's a private annotation and the Kubernetes project has no plans to fix that aspect.
• However, we are breaking API conventions by requiring use of a private label on certain CRDs.
• We should document that private annotation as part of the CRD documentation.

Pages to Update:

• https://kubernetes.io/docs/reference/labels-annotations-taints/
• https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/

Additional Information: /sig api-machinery