Add reference documentation for APIKeyRequest CRD

[eguzki]

Summary

Add a reference documentation page for the APIKeyRequest custom resource definition (CRD).

Background

APIKeyRequest is the shadow resource created by the APIKeyReconciler in the API owner's namespace, mirroring the consumer's APIKey. It enables namespace-based RBAC: owners discover and review access requests in their own namespace without seeing consumer namespaces.

Currently there is no reference documentation for this resource. Users and integrators must read the source code to understand its schema and behavior.

Lifecycle / Ownership

• Created and deleted by the controller (owners do not create these manually)
• Deleted automatically when the originating APIKey is deleted
• Owner interacts by creating an APIKeyApproval referencing this resource

RBAC Notes

• Owners have get/list/watch on APIKeyRequest in their namespace
• Owners do NOT have access to APIKey in consumer namespaces (namespace isolation)
• API key secret values are never projected into APIKeyRequest (only into APIKey status)

Example

apiVersion: devportal.kuadrant.io/v1alpha1
kind: APIKeyRequest
metadata:
  name: my-api-key-request
  namespace: owner-namespace   # same namespace as the APIProduct
spec:
  apiProductRef:
    name: my-api-product
  planTier: basic
  useCase: "Internal integration for payment processing service"
  requestedBy:
    userId: "user-123"
    email: "developer@example.com"
  apiKeyRef:
    name: my-api-key
    namespace: consumer-namespace
status:
  conditions:
    - type: Pending
      status: "True"
      lastTransitionTime: "2026-06-12T10:00:00Z"

Related

• APIKey CRD (api/v1alpha1/apikey_types.go)
• APIKeyApproval CRD (api/v1alpha1/apikeyapproval_types.go)
• RBAC design: https://github.com/Kuadrant/kuadrant-console-plugin/blob/main/docs/designs/2026-03-26-api-management-rbac-design.md