# Integration Adapter Trust Boundary

> Flag integration adapters reading credential-like fields from third-party CRDs without treating them as untrusted (RayCluster, SparkApplication, JobSet).

- Skill: `kubernetes-sigs-kueue/integration-adapter-trust-boundary` (Agent Skill)
- Install (CLI): `npx skillmds@latest add kubernetes-sigs-kueue/integration-adapter-trust-boundary`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kubernetes-sigs-kueue/integration-adapter-trust-boundary/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: Apache-2.0
- Author: kubernetes-sigs (https://skillmd.com/u/kubernetes-sigs-kueue)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/kubernetes-sigs-kueue/integration-adapter-trust-boundary

---


# Skill: Integration-Adapter Trust Boundary

- Adapters in `pkg/controller/jobs/<framework>/` that newly read credential-like
  fields from a third-party CRD (`RayCluster` head-node secret refs, `SparkApplication`
  driver env, JobSet pod template env) without treating those fields as untrusted —
  validate before forwarding, never log, never copy into Kueue-owned status.