Right now, https://github.com/grpc/grpc-go/blob/master/xds/internal/balancer/cdsbalancer/cdsbalancer.go#L155 security configuration for the xDS tree is determined by the top level cluster in the cluster tree in the cds_balancer. This security configuration needs to be per cluster_impl (per priority). The initial idea is to persist a map from cluster name to security configuration in cds_balancer, set a resolver attribute in cluster_impl, and use that name from the attribute to read from the map here: https://github.com/grpc/grpc-go/blob/master/xds/internal/balancer/cdsbalancer/cdsbalancer.go#L674, rather than reading the entire handshake info directly.