> ## Documentation Index
> Fetch the complete documentation index at: https://docs.internal.nscale.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Relationship: Google Borneo Partner Operations API

> The Google Borneo connector as a consumer of Fleet Manager inventory and custody signals.

* **Kind:** Projection
* **Version:** 1
* **Fleet Manager owner:** Fleet Manager squad, #fleet-manager-chat (individual claimant pending)
* **Counterpart owner:** Google via the Nscale account team; internal delivery owner Fleet Manager squad
* **Last reviewed:** 2026-09-09

## What flows

The `google-borneo-connector` (`src/fleet_manager/api/connectors/google/`, ADR-0021 and ADR-0023) consumes
inventory [device](../start-here/glossary#node) events over JetStream and delivers hardware asset register and refresh calls to Google's
Partner Ops API. Two gates sit in front of that: the chart ships `googleBorneoConnector.enabled: false`, and
`validate_only` defaults to true, so an enabled connector on defaults asks Google to validate payloads without
persisting them; persisted registration needs `validateOnly: false` in the environment overlay. The Partner Ops calls
are (`outpostHardwareAssets`, `PATCH outpostRacks`, `testConnectivity`). A polling backstop reads
`GetHardwareAsset` for in-transition and delegated devices and maps Google-side state changes onto Fleet
Manager [custody](../start-here/glossary#customer-custody) transitions, so this projection also carries inbound custody signals. It holds `inventory:read`.

## What breaks if this changes

A Borneo API or auth change crash-loops every enabled connector, validate-only included, because startup runs
`_verify_connectivity_or_raise` and the polling backstop unconditionally; that stops [reclaim](../start-here/glossary#reclaim) signals for assets
already in Borneo. Persisted registration of new hardware is additionally lost only where `validateOnly: false`. A Fleet Manager inventory shape change breaks the transform in
`src/fleet_manager/api/connectors/google/transforms/inventory_to_borneo.py`.

## Enforcement

* **Principal:** `google-borneo-connector`.
* **Mechanism:** towards Fleet Manager, FM OAuth client (private-key JWT) in the hub chart roster; towards Borneo,
  Google service-account impersonation on top of Workload Identity Federation credentials that the
  `product-vault-store` ExternalSecret materialises from [Vault](../start-here/glossary#vault) key `<env>/fm-google-borneo-connector/gcp/adc`
  (`deployment/charts/hub/templates/google-borneo/gcp-credentials.yaml`); towards [NATS](../start-here/glossary#nats), the
  `fleet-google-connector-client` certificate on the Fleet Manager-owned plane (see [nats](./nats)). Startup runs Borneo's `testConnectivity` and crash-loops without the ADC file. Each
  registration also reads the device's `<name>-bmc` item from the hub [1Password](../start-here/glossary#1password) vault (see
  [onepassword](./onepassword)); a missing item dead-letters that device, in `validate_only` mode too, because the
  read happens before the placeholder substitution (`src/fleet_manager/api/connectors/google/reconcilers/outbound.py`).
* Hub roster client `google-borneo-connector`; client in `src/fleet_manager/core/clients/google_borneo/`.
* Settings: `src/fleet_manager/settings/agents/google_borneo.py` (`site_slug`, cluster scope).

## Gaps

* Google has not delivered a webhook; polling is the complete inbound mechanism.

## Change log

* 2026-09-09 v1: created; describes present behaviour.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.