Skip to main content
  • Kind: Projection
  • Version: 1
  • Fleet Manager owner: Fleet Manager squad, #fleet-manager-chat (individual claimant pending)
  • Counterpart owner: Google via the Nscale account team; internal delivery owner Fleet Manager squad
  • Last reviewed: 2026-09-09

​
What flows

The google-borneo-connector (src/fleet_manager/api/connectors/google/, ADR-0021 and ADR-0023) consumes inventory device events over JetStream and delivers hardware asset register and refresh calls to Google’s Partner Ops API. Two gates sit in front of that: the chart ships googleBorneoConnector.enabled: false, and validate_only defaults to true, so an enabled connector on defaults asks Google to validate payloads without persisting them; persisted registration needs validateOnly: false in the environment overlay. The Partner Ops calls are (outpostHardwareAssets, PATCH outpostRacks, testConnectivity). A polling backstop reads GetHardwareAsset for in-transition and delegated devices and maps Google-side state changes onto Fleet Manager custody transitions, so this projection also carries inbound custody signals. It holds inventory:read.

​
What breaks if this changes

A Borneo API or auth change crash-loops every enabled connector, validate-only included, because startup runs _verify_connectivity_or_raise and the polling backstop unconditionally; that stops reclaim signals for assets already in Borneo. Persisted registration of new hardware is additionally lost only where validateOnly: false. A Fleet Manager inventory shape change breaks the transform in src/fleet_manager/api/connectors/google/transforms/inventory_to_borneo.py.

​
Enforcement

  • Principal: google-borneo-connector.
  • Mechanism: towards Fleet Manager, FM OAuth client (private-key JWT) in the hub chart roster; towards Borneo, Google service-account impersonation on top of Workload Identity Federation credentials that the product-vault-store ExternalSecret materialises from Vault key <env>/fm-google-borneo-connector/gcp/adc (deployment/charts/hub/templates/google-borneo/gcp-credentials.yaml); towards NATS, the fleet-google-connector-client certificate on the Fleet Manager-owned plane (see nats). Startup runs Borneo’s testConnectivity and crash-loops without the ADC file. Each registration also reads the device’s <name>-bmc item from the hub 1Password vault (see onepassword); a missing item dead-letters that device, in validate_only mode too, because the read happens before the placeholder substitution (src/fleet_manager/api/connectors/google/reconcilers/outbound.py).
  • Hub roster client google-borneo-connector; client in src/fleet_manager/core/clients/google_borneo/.
  • Settings: src/fleet_manager/settings/agents/google_borneo.py (site_slug, cluster scope).

​
Gaps

  • Google has not delivered a webhook; polling is the complete inbound mechanism.

​
Change log

  • 2026-09-09 v1: created; describes present behaviour.