Add release note for istioctl 1.17 auth plugin removal (#12696)

* Add release note for istioctl 1.17 auth plugin removal

Signed-off-by: Keith Mattix II <keithmattix2@gmail.com>

* Respond to PR comments

Signed-off-by: Keith Mattix II <keithmattix2@gmail.com>

* Put version in backticks

Signed-off-by: Keith Mattix II <keithmattix2@gmail.com>

---------

Signed-off-by: Keith Mattix II <keithmattix2@gmail.com>

.spelling

@@ -599,6 +599,7 @@ kubeconfig
 kubectl
 kubelet
 Kubelet
+kubelogin
 Kubernetes
 kubernetes.default
 KubeSphere

content/en/news/releases/1.17.x/announcing-1.17/change-notes/index.md

@@ -120,6 +120,8 @@ These notices describe functionality that will be removed in a future release ac
 
 - **Updated** `admin log`'s `-r` flag to be shorthand for `--revision` for consistency with other commands (originally `-r` was shorthand for `--reset`). [PR #41321](https://github.com/istio/istio/pull/41321)
 
+- **Updated** `client-go` to `v1.26.1`, removing support for `azure` and `gcp` auth plugins. [PR #43101](https://github.com/istio/istio/pull/43101)
+
 - **Added** `istioctl proxy-config ecds` to support retrieving typed extension configuration from Envoy for a specified pod. [PR #42365](https://github.com/istio/istio/pull/42365)
 
 - **Added** the ability to set proxy log level for all pods in a deployment for `istioctl proxy-config log` command. [Issue #42919](https://github.com/istio/istio/issues/42919)

content/en/news/releases/1.17.x/announcing-1.17/upgrade-notes/index.md

@@ -15,3 +15,7 @@ Users upgrading from 1.15.x to Istio 1.17 should also reference the [1.16 change
 
 If you are using the [Kubernetes Gateway](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io%2fv1beta1.Gateway)
 to manage your Istio gateways, the names of the `Kubernetes Deployment` and `Service` has been modified. The default `Service Account` used has also switched to use its own token. To continue using the old convention during upgrades, the `gateway.istio.io/name-override` and `gateway.istio.io/service-account` annotations can be used.
+
+## Client-go auth plugins removed
+
+istioctl 1.17 contains an upgraded version of client-go with the `gcp` and `azure` auth plugins *removed* (similar to the kubectl 1.26 [release](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#deprecation)). See [kubelogin](https://github.com/Azure/kubelogin) and [Kubectl Auth Changes in GKE](https://cloud.google.com/blog/products/containers-kubernetes/kubectl-auth-changes-in-gke) for details about the cloud-specific replacements. After migrating, be sure to update/regenerate your kubeconfig files before using istioctl.