apiVersion: release-notes/v2
kind: bug-fix
area: installation
releaseNotes:
- |
  **Removed** support for a number of nonstandard kubeconfig authentication methods when using multicluster secret.

upgradeNotes:
- title: Multicluster Secret Authentication Changes
  content: |
    When kubeconfig files are created to [enable endpoint discovery](https://istio.io/latest/docs/setup/install/multicluster/multi-primary/#enable-endpoint-discovery)
    in multicluster installations, the authentication methods allowed in the configuration is now limited.

    The two authentication methods output but `istioctl create-remote-secret` (`oidc` and `token`), are not impacted.
    As a result, only users that are creating custom kubeconfig files will be impacted.

    A new environment variable, `PILOT_INSECURE_MULTICLUSTER_KUBECONFIG_OPTIONS`, is added to Istiod to enable the methods that were removed.
    For example, if `exec` authentication is used, set `PILOT_INSECURE_MULTICLUSTER_KUBECONFIG_OPTIONS=exec`.
