docs: make the cloud capture gcp tabs read standalone

[tooky]

Summary

Until now, parts of the Cloud Capture GCP tabs only made sense if you'd already read the AWS tab. For example, the workload identity checks were defined as the "counterpart" of the AWS trust policy and external ID, and the setup steps said "GCP has no equivalent of phone-home". This PR rewrites the GCP content to explain each mechanism in GCP terms first. Where an AWS comparison still helps, it follows as a short optional aside. The AWS tab content is unchanged.

Security page

• The intro above the tabs is now cloud-neutral: it describes "an identity in your cloud account" rather than an IAM role with an assume-trust policy.
• The GCP trust explanation now states the two checks the pool makes (Kosli AWS account, then your organization's Kosli-side role), with the AWS comparison as an aside.
• The kosli_role_name and attribute_condition comments in the Terraform are reworded the same way.
• "How Kosli isolates tenants" is split into AWS and GCP tabs. The AWS text moved into its tab without edits.
• "Changing security permissions" no longer assumes an IAM role.
• GKE permissions now match how snapshots actually work. The section assumed Cloud Capture calls each cluster's Kubernetes API. It reads pods from Cloud Asset Inventory, the same way kosli snapshot gke does. So:
  • the note saying clusters with a private-only control plane can't be snapshotted is removed
  • the custom role swaps container.namespaces.* and container.pods.* for cloudasset.assets.listContainerPod and serviceusage.services.use
  • the Terraform now enables cloudasset.googleapis.com
  • the security-review comment explains why a custom role is used rather than roles/cloudasset.viewer (which can also list k8s.io/Secret)

Getting started page, GCP tab:

 ### Prepare your environment
-  ...Kubernetes clusters...
+  ...GKE clusters...
-  "phone-home" paragraph
+  <Steps>
+    Download the Terraform configuration
+    Deploy with Infrastructure Manager   # gcloud apply command, copied from the security page
+    Share the outputs with Kosli         # names the two outputs
+  </Steps>
 ### Enable Cloud Capture    # now names the two values you share

The overview's first step now says "Grant Kosli read-only access to your cloud accounts" rather than "Create an IAM role".

Still to do

The three items below aren't confirmed, so the pages carry {/* TODO */} comments for them. These are hidden on the rendered site.

• Does the Terraform downloaded from the Settings page come pre-filled with the Kosli AWS account ID and role name? If not, where does the user get them?
• Where does the user submit the two outputs: a form in the Kosli UI, or Customer Success?
• Does Cloud Capture still discover clusters with container.clusters.list and container.clusters.get? If discovery also goes through Cloud Asset Inventory, those two permissions and the discovery comment in the role need changing.

Also worth checking:

• Does gcloud infra-manager deployments describe actually show Terraform outputs? They may only appear on the revision (gcloud infra-manager revisions describe, under applyResults.outputs). The wording is unchanged from before, but it's now presented as a step users follow.
• The GCP Terraform on the security page has no source file in this repo, capture-managed or cloud-capture. Wherever the Settings-page download is generated, it needs the same changes: the reworded comments, the Cloud Asset permissions, and enabling the Cloud Asset API.

Evidence

• pytest tests/: 59 passed.
• mint dev: both pages render with the new tabs, steps and code blocks, and the TODO comments don't appear.
• mint broken-links: one broken link, in tutorials/working_with_controls.mdx, which this PR doesn't touch.

Merge Danger

Door: two-way. This is a docs-only change to two BETA pages and can be reverted cleanly.
Blast Radius: two pages under Administration ▸ Cloud Capture. No navigation, redirect or anchor changes. Customers who already followed the old GKE permissions would have a role without the Cloud Asset permissions, but GCP support is still marked "coming soon".

🤖 Generated with Claude Code

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
kosli	🟢 Ready	View Preview	Oct 15, 2026, 2:49 PM

[claude]

Claude finished @tooky's task in 1m 17s —— View job

---

Reviewed new commits (2448005..3f959a9)

• Fetch previous review comments
• Diff BEFORE..AFTER
• Assess status of each previous finding
• Flag any new bugs/regressions in changed lines
• Post summary comment

Previous finding — gcloud infra-manager deployments describe may not return Terraform outputs (flagged on getting_started.md:91, also present in security.md:143 and the Terraform comment at security.md:260): not addressed. These two commits only touch the GKE/Cloud Asset Inventory rewrite and remove the "Prerequisites" section (private-endpoint note) — none of the gcloud infra-manager deployments describe wording changed. This is still an open "Still to do" item per the PR body.

New changes in this push (removing the private-control-plane prerequisite, switching GKE permissions to Cloud Asset Inventory): internally consistent — no dangling references to the removed "Prerequisites" heading or the old "connects to each cluster's Kubernetes API" claim remain in either file, and the custom-role permissions/comments match the new Cloud Asset Inventory explanation. No new bugs or regressions found; 0 new inline comments.

[claude]

Improvement: this is now a step readers follow, and as far as I know gcloud infra-manager deployments describe doesn't return Terraform outputs. The Deployment resource only points at latestRevision. The outputs are on the revision, under applyResults.outputs. You already list this as unverified in the PR body. If it holds, a reader who runs this command won't find the values this step asks them to share.

If verified, consider spelling out the command, e.g.:

Suggested change

	Share them with Kosli after the deployment completes. You can read them at any time with `gcloud infra-manager deployments describe`.
	Share them with Kosli after the deployment completes. You can read them at any time from the deployment's latest revision:
	```bash
	gcloud infra-manager revisions describe \
	"$(gcloud infra-manager deployments describe \
	projects/<your-gcp-project>/locations/<your-gcp-region>/deployments/kosli-capture \
	--format='value(latestRevision)')" \
	--format='yaml(applyResults.outputs)'
	```

The same wording also appears in administration/cloud_capture/security.md:143 and in the Terraform comment at security.md:260.

[mbevc1]

I've noticed this comment elsewhere but testing was pretty instant. But I could find what guarantees GCP offers around events coming in there.

[gsavage]

To answer a couple of the open questions- the Terraform code will not be prepopulated with the correct values; the values are visible in the Kosli UI only (in the new settings page).

We have a new API endpoint for registering Cloud accounts, so they "let us know" by making f a POST request there