Right now,https://github.com/grpc/grpc-go/blob/master/xds/internal/balancer/cdsbalancer/cdsbalancer.go#L155security configuration for the xDS tree is determined by the top level cluster in the cluster tree in the cds_balancer. This security configuration needs to be per cluster_impl (per priority). The initial idea is to persist a map from cluster name to security configuration in cds_balancer, set a resolver attribute in cluster_impl, and use that name from the attribute to read from the map here:https://github.com/grpc/grpc-go/blob/master/xds/internal/balancer/cdsbalancer/cdsbalancer.go#L674,rather than reading the entire handshake info directly.