Repository: kumahq/kuma
Pull request #1743 (2021-04-01 16:02:06)

chore(kuma-dp) better error messages when there is problem with pod convertion
On Kubernetes when Dataplane is not converted from Pod we got 404 and we retry it on kuma-dp.

When we retry we print msg
`Dataplane entity is not yet found in the Control Plane. If you are running on Kubernetes, CP is most likely still in the process of converting Pod to Dataplane. Retrying.`
and eventually if the problem persist we end a process with
`Dataplane entity not found. If you are running on Universal please create a Dataplane entity on kuma-cp before starting kuma-dp. If you are running on Kubernetes, please check the kuma-cp logs to determine why the Dataplane entity could not be created by the automatic sidecar injection.`

We should hint the users that they should check CP logs while waiting for Dataplane (not only after all the retries). It most likely something wrong on the CP side.


Patch:
diff --git a/app/kuma-dp/cmd/run.go b/app/kuma-dp/cmd/run.go
index e155ac406..85e4f89b7 100644
--- a/app/kuma-dp/cmd/run.go
+++ b/app/kuma-dp/cmd/run.go
@@ -147,7 +147,7 @@ func newRunCmd(rootCtx *RootContext) *cobra.Command {
 	cmd.PersistentFlags().Var(&cfg.Dataplane.AdminPort, "admin-port", `Port (or range of ports to choose from) for Envoy Admin API to listen on. Empty value indicates that Envoy Admin API should not be exposed over TCP. Format: "9901 | 9901-9999 | 9901- | -9901"`)
 	cmd.PersistentFlags().StringVar(&cfg.Dataplane.Mesh, "mesh", cfg.Dataplane.Mesh, "Mesh that Dataplane belongs to")
 	cmd.PersistentFlags().StringVar(&cfg.ControlPlane.URL, "cp-address", cfg.ControlPlane.URL, "URL of the Control Plane Dataplane Server. Example: https://localhost:5678")
-	cmd.PersistentFlags().StringVar(&cfg.ControlPlane.CaCertFile, "ca-cert-file", cfg.ControlPlane.CaCert, "Path to CA cert by which connection to the Control Plane will be verified if HTTPS is used")
+	cmd.PersistentFlags().StringVar(&cfg.ControlPlane.CaCertFile, "ca-cert-file", cfg.ControlPlane.CaCertFile, "Path to CA cert by which connection to the Control Plane will be verified if HTTPS is used")
 	cmd.PersistentFlags().StringVar(&cfg.DataplaneRuntime.BinaryPath, "binary-path", cfg.DataplaneRuntime.BinaryPath, "Binary path of Envoy executable")
 	cmd.PersistentFlags().StringVar(&cfg.Dataplane.BootstrapVersion, "bootstrap-version", cfg.Dataplane.BootstrapVersion, "Bootstrap version (and API version) of xDS config. If empty, default version defined in Kuma CP will be used. (ex. '2', '3')")
 	cmd.PersistentFlags().StringVar(&cfg.DataplaneRuntime.ConfigDir, "config-dir", cfg.DataplaneRuntime.ConfigDir, "Directory in which Envoy config will be generated")
diff --git a/app/kuma-dp/pkg/dataplane/envoy/remote_bootstrap.go b/app/kuma-dp/pkg/dataplane/envoy/remote_bootstrap.go
index 544e02ccd..391f3ddd7 100644
--- a/app/kuma-dp/pkg/dataplane/envoy/remote_bootstrap.go
+++ b/app/kuma-dp/pkg/dataplane/envoy/remote_bootstrap.go
@@ -31,7 +31,7 @@ func NewRemoteBootstrapGenerator(client *http.Client) BootstrapConfigFactoryFunc
 
 var (
 	log           = core.Log.WithName("dataplane")
-	DpNotFoundErr = errors.New("Dataplane entity not found. If you are running on Universal please create a Dataplane entity on kuma-cp before starting kuma-dp. If you are running on Kubernetes, please check the kuma-cp logs to determine why the Dataplane entity could not be created by the automatic sidecar injection.")
+	DpNotFoundErr = errors.New("Dataplane entity not found. If you are running on Universal please create a Dataplane entity on kuma-cp before starting kuma-dp or pass it to kuma-dp run --dataplane-file=/file. If you are running on Kubernetes, please check the kuma-cp logs to determine why the Dataplane entity could not be created by the automatic sidecar injection.")
 )
 
 func InvalidRequestErr(msg string) error {
@@ -83,7 +83,7 @@ func (b *remoteBootstrap) Generate(url string, cfg kuma_dp.Config, params Bootst
 
 		switch err {
 		case DpNotFoundErr:
-			log.Info("Dataplane entity is not yet found in the Control Plane. If you are running on Kubernetes, CP is most likely still in the process of converting Pod to Dataplane. Retrying.", "backoff", cfg.ControlPlane.Retry.Backoff)
+			log.Info("Dataplane entity is not yet found in the Control Plane. If you are running on Kubernetes, CP is most likely still in the process of converting Pod to Dataplane. If it takes too long, check kuma-cp logs. Retrying.", "backoff", cfg.ControlPlane.Retry.Backoff)
 		default:
 			log.Info("could not fetch bootstrap configuration. Retrying.", "backoff", cfg.ControlPlane.Retry.Backoff, "err", err.Error())
 		}
@@ -105,15 +105,27 @@ func (b *remoteBootstrap) requestForBootstrap(url *net_url.URL, cfg kuma_dp.Conf
 		}
 		dataplaneResource = string(dpJSON)
 	}
+	token := ""
+	if cfg.DataplaneRuntime.TokenPath != "" {
+		tokenData, err := ioutil.ReadFile(cfg.DataplaneRuntime.TokenPath)
+		if err != nil {
+			return nil, "", err
+		}
+		token = string(tokenData)
+	}
+	if cfg.DataplaneRuntime.Token != "" {
+		token = cfg.DataplaneRuntime.Token
+	}
 	request := types.BootstrapRequest{
 		Mesh: cfg.Dataplane.Mesh,
 		Name: cfg.Dataplane.Name,
 		// if not set in config, the 0 will be sent which will result in providing default admin port
 		// that is set in the control plane bootstrap params
-		AdminPort:          cfg.Dataplane.AdminPort.Lowest(),
-		DataplaneTokenPath: cfg.DataplaneRuntime.TokenPath,
-		DataplaneResource:  dataplaneResource,
-		BootstrapVersion:   params.BootstrapVersion,
+		AdminPort:         cfg.Dataplane.AdminPort.Lowest(),
+		DataplaneToken:    token,
+		DataplaneResource: dataplaneResource,
+		BootstrapVersion:  params.BootstrapVersion,
+		CaCert:            cfg.ControlPlane.CaCert,
 		Version: types.Version{
 			KumaDp: types.KumaDpVersion{
 				Version:   kuma_version.Build.Version,
diff --git a/pkg/core/xds/metadata.go b/pkg/core/xds/metadata.go
index 79a976315..7488ae73b 100644
--- a/pkg/core/xds/metadata.go
+++ b/pkg/core/xds/metadata.go
@@ -17,6 +17,7 @@ const (
 	// Supported Envoy node metadata fields.
 
 	fieldDataplaneTokenPath         = "dataplaneTokenPath"
+	fieldDataplaneToken             = "dataplane.token"
 	fieldDataplaneAdminPort         = "dataplane.admin.port"
 	fieldDataplaneDataplaneResource = "dataplane.resource"
 	fieldDynamicMetadata            = "dynamicMetadata"
@@ -38,6 +39,7 @@ const (
 // to generate xDS resources that depend on environment-specific configuration.
 type DataplaneMetadata struct {
 	DataplaneTokenPath string
+	DataplaneToken     string
 	DataplaneResource  *core_mesh.DataplaneResource
 	AdminPort          uint32
 	DynamicMetadata    map[string]string
@@ -50,6 +52,13 @@ func (m *DataplaneMetadata) GetDataplaneTokenPath() string {
 	return m.DataplaneTokenPath
 }
 
+func (m *DataplaneMetadata) GetDataplaneToken() string {
+	if m == nil {
+		return ""
+	}
+	return m.DataplaneToken
+}
+
 func (m *DataplaneMetadata) GetDataplaneResource() *core_mesh.DataplaneResource {
 	if m == nil {
 		return nil
@@ -79,6 +88,9 @@ func DataplaneMetadataFromXdsMetadata(xdsMetadata *_struct.Struct) *DataplaneMet
 	if field := xdsMetadata.Fields[fieldDataplaneTokenPath]; field != nil {
 		metadata.DataplaneTokenPath = field.GetStringValue()
 	}
+	if field := xdsMetadata.Fields[fieldDataplaneToken]; field != nil {
+		metadata.DataplaneToken = field.GetStringValue()
+	}
 	if value := xdsMetadata.Fields[fieldDataplaneAdminPort]; value != nil {
 		if port, err := strconv.Atoi(value.GetStringValue()); err == nil {
 			metadata.AdminPort = uint32(port)
diff --git a/pkg/xds/bootstrap/generator.go b/pkg/xds/bootstrap/generator.go
index 8b0410e62..38ad35f51 100644
--- a/pkg/xds/bootstrap/generator.go
+++ b/pkg/xds/bootstrap/generator.go
@@ -91,6 +91,9 @@ var DpTokenRequired = errors.New("Dataplane Token is required. Generate token us
 
 var InvalidBootstrapVersion = errors.New(`Invalid BootstrapVersion. Available values are: "2", "3"`)
 
+var NotCA = errors.New("A data plane proxy is trying to verify the control plane using the certificate which is not a certificate authority (basic constraint 'CA' is set to 'false').\n" +
+	"Provide CA that was used to sign a certificate used in the control plane by using 'kuma-dp run --ca-cert-file=file' or via KUMA_CONTROL_PLANE_CA_CERT_FILE")
+
 func SANMismatchErr(host string, sans []string) error {
 	return errors.Errorf("A data plane proxy is trying to connect to the control plane using %q address, but the certificate in the control plane has the following SANs %q. "+
 		"Either change the --cp-address in kuma-dp to one of those or execute the following steps:\n"+
@@ -107,7 +110,7 @@ func ISSANMismatchErr(err error) bool {
 }
 
 func (b *bootstrapGenerator) validateRequest(request types.BootstrapRequest) error {
-	if b.dpAuthEnabled && request.DataplaneTokenPath == "" {
+	if b.dpAuthEnabled && request.DataplaneTokenPath == "" && request.DataplaneToken == "" {
 		return DpTokenRequired
 	}
 	if b.config.Params.XdsHost == "" { // XdsHost takes precedence over Host in the request, so validate only when it is not set
@@ -115,6 +118,11 @@ func (b *bootstrapGenerator) validateRequest(request types.BootstrapRequest) err
 			return SANMismatchErr(request.Host, b.hostsAndIps.slice())
 		}
 	}
+	if request.DataplaneToken != "" && request.DataplaneTokenPath != "" {
+		verr := validators.ValidationError{}
+		verr.AddViolation("dataplaneToken", "only one of dataplaneToken and dataplaneTokenField can be defined")
+		return verr.OrNil()
+	}
 	return nil
 }
 
@@ -178,14 +186,15 @@ func (b *bootstrapGenerator) generateFor(proxyId core_xds.ProxyId, dataplane *co
 		return nil, "", err
 	}
 
-	var certBytes = ""
-	if b.xdsCertFile != "" {
-		cert, err := ioutil.ReadFile(b.xdsCertFile)
-		if err != nil {
-			return nil, "", err
-		}
-		certBytes = base64.StdEncoding.EncodeToString(cert)
+	cert, origin, err := b.caCert(request)
+	if err != nil {
+		return nil, "", err
 	}
+
+	if err := b.validateCaCert(cert, origin, request); err != nil {
+		return nil, "", err
+	}
+
 	accessLogSocket := envoy_common.AccessLogSocketName(request.Name, request.Mesh)
 	params := configParameters{
 		Id:                 proxyId.String(),
@@ -198,8 +207,9 @@ func (b *bootstrapGenerator) generateFor(proxyId core_xds.ProxyId, dataplane *co
 		XdsConnectTimeout:  b.config.Params.XdsConnectTimeout,
 		AccessLogPipe:      accessLogSocket,
 		DataplaneTokenPath: request.DataplaneTokenPath,
+		DataplaneToken:     request.DataplaneToken,
 		DataplaneResource:  request.DataplaneResource,
-		CertBytes:          certBytes,
+		CertBytes:          base64.StdEncoding.EncodeToString(cert),
 		KumaDpVersion:      request.Version.KumaDp.Version,
 		KumaDpGitTag:       request.Version.KumaDp.GitTag,
 		KumaDpGitCommit:    request.Version.KumaDp.GitCommit,
@@ -213,6 +223,46 @@ func (b *bootstrapGenerator) generateFor(proxyId core_xds.ProxyId, dataplane *co
 	return b.configForParameters(params, request.BootstrapVersion)
 }
 
+func (b *bootstrapGenerator) validateCaCert(cert []byte, origin string, request types.BootstrapRequest) error {
+	if request.DataplaneTokenPath != "" {
+		// when using GoogleGRPC it is valid to put non-CA certificate therefore we should only verify this for EnvoyGRPC
+		// EnvoyGRPC is used when DataplaneToken is passed via request as inline value, not as a file.
+		return nil
+	}
+
+	pemCert, _ := pem.Decode(cert)
+	if pemCert == nil {
+		return errors.New("could not parse certificate from " + origin)
+	}
+	x509Cert, err := x509.ParseCertificate(pemCert.Bytes)
+	if err != nil {
+		return errors.Wrap(err, "could not parse certificate from "+origin)
+	}
+	// checking just x509Cert.IsCA is not enough, because it's valid to generate CA without CA:TRUE basic constraint
+	if x509Cert.BasicConstraintsValid && !x509Cert.IsCA {
+		return NotCA
+	}
+	return nil
+}
+
+// caCert gets CA cert that was used to signed cert that DP server is protected with.
+// Technically result of this function does not have to be a valid CA.
+// When user provides custom cert + key and does not provide --ca-cert-file to kuma-dp run, this can return just a regular cert
+func (b *bootstrapGenerator) caCert(request types.BootstrapRequest) ([]byte, string, error) {
+	// CaCert from the request takes precedence. It is only visible if user provides --ca-cert-file to kuma-dp run
+	if request.CaCert != "" {
+		return []byte(request.CaCert), "request .CaCert", nil
+	}
+	if b.xdsCertFile != "" {
+		file, err := ioutil.ReadFile(b.xdsCertFile)
+		if err != nil {
+			return nil, "file " + b.xdsCertFile, err
+		}
+		return file, "", nil
+	}
+	return nil, "", nil
+}
+
 func (b *bootstrapGenerator) xdsHost(request types.BootstrapRequest) string {
 	if b.config.Params.XdsHost != "" { // XdsHost from config takes precedence over Host from request
 		return b.config.Params.XdsHost
@@ -314,7 +364,7 @@ func hostsAndIPsFromCertFile(dpServerCertFile string) (SANSet, error) {
 	}
 	pemCert, _ := pem.Decode(certBytes)
 	if pemCert == nil {
-		return nil, errors.Wrap(err, "could not parse certificate")
+		return nil, errors.New("could not parse certificate")
 	}
 	cert, err := x509.ParseCertificate(pemCert.Bytes)
 	if err != nil {
diff --git a/pkg/xds/bootstrap/handler.go b/pkg/xds/bootstrap/handler.go
index 81139dda0..455033f80 100644
--- a/pkg/xds/bootstrap/handler.go
+++ b/pkg/xds/bootstrap/handler.go
@@ -73,7 +73,7 @@ func (b *BootstrapHandler) Handle(resp http.ResponseWriter, req *http.Request) {
 }
 
 func handleError(resp http.ResponseWriter, err error, logger logr.Logger) {
-	if err == DpTokenRequired {
+	if err == DpTokenRequired || store.IsResourcePreconditionFailed(err) || validators.IsValidationError(err) {
 		resp.WriteHeader(http.StatusUnprocessableEntity)
 		_, err = resp.Write([]byte(err.Error()))
 		if err != nil {
@@ -81,41 +81,17 @@ func handleError(resp http.ResponseWriter, err error, logger logr.Logger) {
 		}
 		return
 	}
-	if err == InvalidBootstrapVersion {
+	if err == InvalidBootstrapVersion || ISSANMismatchErr(err) || err == NotCA {
 		resp.WriteHeader(http.StatusBadRequest)
 		if _, err := resp.Write([]byte(err.Error())); err != nil {
 			logger.Error(err, "Error while writing the response")
 		}
 		return
 	}
-	if ISSANMismatchErr(err) {
-		resp.WriteHeader(http.StatusBadRequest)
-		_, err = resp.Write([]byte(err.Error()))
-		if err != nil {
-			logger.Error(err, "Error while writing the response")
-		}
-		return
-	}
 	if store.IsResourceNotFound(err) {
 		resp.WriteHeader(http.StatusNotFound)
 		return
 	}
-	if store.IsResourcePreconditionFailed(err) {
-		resp.WriteHeader(http.StatusUnprocessableEntity)
-		_, err = resp.Write([]byte(err.Error()))
-		if err != nil {
-			logger.Error(err, "Error while writing the response")
-		}
-		return
-	}
-	if validators.IsValidationError(err) {
-		resp.WriteHeader(http.StatusUnprocessableEntity)
-		_, err = resp.Write([]byte(err.Error()))
-		if err != nil {
-			logger.Error(err, "Error while writing the response")
-		}
-		return
-	}
 	logger.Error(err, "Could not generate a bootstrap configuration")
 	resp.WriteHeader(http.StatusInternalServerError)
 }
diff --git a/pkg/xds/bootstrap/parameters.go b/pkg/xds/bootstrap/parameters.go
index 3a7b4ad3c..7fb28424c 100644
--- a/pkg/xds/bootstrap/parameters.go
+++ b/pkg/xds/bootstrap/parameters.go
@@ -12,6 +12,7 @@ type configParameters struct {
 	XdsPort            uint32
 	XdsConnectTimeout  time.Duration
 	AccessLogPipe      string
+	DataplaneToken     string
 	DataplaneTokenPath string
 	DataplaneResource  string
 	CertBytes          string
diff --git a/pkg/xds/bootstrap/template_v2.go b/pkg/xds/bootstrap/template_v2.go
index 2e2407199..bc27630a3 100644
--- a/pkg/xds/bootstrap/template_v2.go
+++ b/pkg/xds/bootstrap/template_v2.go
@@ -8,6 +8,9 @@ node:
 {{if .DataplaneTokenPath}}
     dataplaneTokenPath: {{.DataplaneTokenPath}}
 {{end}}
+{{if .DataplaneToken }}
+    dataplane.token: "{{.DataplaneToken}}"
+{{end}}
 {{if .DataplaneResource}}
     dataplane.resource: '{{.DataplaneResource}}'
 {{end}}
@@ -59,9 +62,10 @@ stats_config:
 hds_config:
   api_type: GRPC
   transport_api_version: V3
+  set_node_on_first_message_only: true
   grpc_services:
-  - googleGrpc:
 {{ if .DataplaneTokenPath }}
+  - googleGrpc:
       callCredentials:
       - fromPlugin:
           name: envoy.grpc_credentials.file_based_metadata
@@ -70,7 +74,6 @@ hds_config:
             secretData:
               filename: {{ .DataplaneTokenPath }}
       credentialsFactoryName: envoy.grpc_credentials.file_based_metadata
-{{ end }}
 {{ if .CertBytes}}
       channelCredentials:
         sslCredentials:
@@ -79,7 +82,15 @@ hds_config:
 {{ end }}
       statPrefix: hds
       targetUri: {{ .XdsHost }}:{{ .XdsPort }}
-  set_node_on_first_message_only: true
+{{ else }}
+    - envoy_grpc:
+        cluster_name: ads_cluster
+{{ if .DataplaneToken }}
+      initialMetadata:
+      - key: "authorization"
+        value: "{{ .DataplaneToken }}"
+{{ end }}
+{{ end }}
 {{ end }}
 
 dynamic_resources:
@@ -90,8 +101,8 @@ dynamic_resources:
     transport_api_version: V2
     timeout: {{ .XdsConnectTimeout }}
     grpc_services:
-    - googleGrpc:
 {{ if .DataplaneTokenPath }}
+    - googleGrpc:
         callCredentials:
         - fromPlugin:
             name: envoy.grpc_credentials.file_based_metadata
@@ -100,7 +111,6 @@ dynamic_resources:
               secretData:
                 filename: {{ .DataplaneTokenPath }}
         credentialsFactoryName: envoy.grpc_credentials.file_based_metadata
-{{ end }}
 {{ if .CertBytes}}
         channelCredentials:
           sslCredentials:
@@ -109,6 +119,15 @@ dynamic_resources:
 {{ end }}
         statPrefix: ads
         targetUri: {{ .XdsHost }}:{{ .XdsPort }}
+{{ else }}
+    - envoy_grpc:
+        cluster_name: ads_cluster
+{{ if .DataplaneToken }}
+      initialMetadata:
+      - key: "authorization"
+        value: "{{ .DataplaneToken }}"
+{{ end }}
+{{ end }}
 static_resources:
   clusters:
   - name: access_log_sink
@@ -128,4 +147,37 @@ static_resources:
             address:
               pipe:
                 path: {{ .AccessLogPipe }}
+  - name: ads_cluster
+    connect_timeout: {{ .XdsConnectTimeout }}
+    type: STRICT_DNS
+    lb_policy: ROUND_ROBIN
+    http2_protocol_options: {}
+    upstream_connection_options:
+      # configure a TCP keep-alive to detect and reconnect to the admin
+      # server in the event of a TCP socket half open connection
+      tcp_keepalive: {}
+    load_assignment:
+      cluster_name: ads_cluster
+      endpoints:
+      - lb_endpoints:
+        - endpoint:
+            address:
+              socket_address:
+                address: {{ .XdsHost }}
+                port_value: {{ .XdsPort }}
+    transport_socket:
+      name: envoy.transport_sockets.tls
+      typed_config:
+        '@type': type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext
+        sni: {{ .XdsHost }}
+        common_tls_context:
+          tls_params:
+            tls_minimum_protocol_version: TLSv1_2
+          validation_context:
+            match_subject_alt_names:
+            - exact: {{ .XdsHost }}
+{{ if .CertBytes }}
+            trusted_ca:
+              inline_bytes: "{{ .CertBytes }}"
+{{ end }}
 `
diff --git a/pkg/xds/bootstrap/template_v3.go b/pkg/xds/bootstrap/template_v3.go
index ff648aeea..bb8b51cb9 100644
--- a/pkg/xds/bootstrap/template_v3.go
+++ b/pkg/xds/bootstrap/template_v3.go
@@ -8,6 +8,9 @@ node:
 {{if .DataplaneTokenPath}}
     dataplaneTokenPath: {{.DataplaneTokenPath}}
 {{end}}
+{{if .DataplaneToken }}
+    dataplane.token: "{{.DataplaneToken}}"
+{{end}}
 {{if .DataplaneResource}}
     dataplane.resource: '{{.DataplaneResource}}'
 {{end}}
@@ -59,9 +62,10 @@ stats_config:
 hds_config:
   api_type: GRPC
   transport_api_version: V3
+  set_node_on_first_message_only: true
   grpc_services:
-  - googleGrpc:
 {{ if .DataplaneTokenPath }}
+  - googleGrpc:
       callCredentials:
       - fromPlugin:
           name: envoy.grpc_credentials.file_based_metadata
@@ -70,7 +74,6 @@ hds_config:
             secretData:
               filename: {{ .DataplaneTokenPath }}
       credentialsFactoryName: envoy.grpc_credentials.file_based_metadata
-{{ end }}
 {{ if .CertBytes}}
       channelCredentials:
         sslCredentials:
@@ -79,7 +82,15 @@ hds_config:
 {{ end }}
       statPrefix: hds
       targetUri: {{ .XdsHost }}:{{ .XdsPort }}
-  set_node_on_first_message_only: true
+{{ else }}
+    - envoy_grpc:
+        cluster_name: ads_cluster
+{{ if .DataplaneToken }}
+      initialMetadata:
+      - key: "authorization"
+        value: "{{ .DataplaneToken }}"
+{{ end }}
+{{ end }}
 {{ end }}
 
 dynamic_resources:
@@ -94,8 +105,8 @@ dynamic_resources:
     transport_api_version: V3
     timeout: {{ .XdsConnectTimeout }}
     grpc_services:
-    - googleGrpc:
 {{ if .DataplaneTokenPath }}
+    - googleGrpc:
         callCredentials:
         - fromPlugin:
             name: envoy.grpc_credentials.file_based_metadata
@@ -104,7 +115,6 @@ dynamic_resources:
               secretData:
                 filename: {{ .DataplaneTokenPath }}
         credentialsFactoryName: envoy.grpc_credentials.file_based_metadata
-{{ end }}
 {{ if .CertBytes}}
         channelCredentials:
           sslCredentials:
@@ -113,6 +123,15 @@ dynamic_resources:
 {{ end }}
         statPrefix: ads
         targetUri: {{ .XdsHost }}:{{ .XdsPort }}
+{{ else }}
+    - envoy_grpc:
+        cluster_name: ads_cluster
+{{ if .DataplaneToken }}
+      initialMetadata:
+      - key: "authorization"
+        value: "{{ .DataplaneToken }}"
+{{ end }}
+{{ end }}
 static_resources:
   clusters:
   - name: access_log_sink
@@ -132,4 +151,37 @@ static_resources:
             address:
               pipe:
                 path: {{ .AccessLogPipe }}
+  - name: ads_cluster
+    connect_timeout: {{ .XdsConnectTimeout }}
+    type: STRICT_DNS
+    lb_policy: ROUND_ROBIN
+    http2_protocol_options: {}
+    upstream_connection_options:
+      # configure a TCP keep-alive to detect and reconnect to the admin
+      # server in the event of a TCP socket half open connection
+      tcp_keepalive: {}
+    load_assignment:
+      cluster_name: ads_cluster
+      endpoints:
+      - lb_endpoints:
+        - endpoint:
+            address:
+              socket_address:
+                address: {{ .XdsHost }}
+                port_value: {{ .XdsPort }}
+    transport_socket:
+      name: envoy.transport_sockets.tls
+      typed_config:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        sni: {{ .XdsHost }}
+        common_tls_context:
+          tls_params:
+            tls_minimum_protocol_version: TLSv1_2
+          validation_context:
+            match_subject_alt_names:
+            - exact: {{ .XdsHost }}
+{{ if .CertBytes }}
+            trusted_ca:
+              inline_bytes: "{{ .CertBytes }}"
+{{ end }}
 `
diff --git a/pkg/xds/bootstrap/types/bootstrap_request.go b/pkg/xds/bootstrap/types/bootstrap_request.go
index 4d4a6d31f..58bd907bb 100644
--- a/pkg/xds/bootstrap/types/bootstrap_request.go
+++ b/pkg/xds/bootstrap/types/bootstrap_request.go
@@ -13,14 +13,17 @@ const (
 const BootstrapVersionHeader = "kuma-bootstrap-version"
 
 type BootstrapRequest struct {
-	Mesh               string            `json:"mesh"`
-	Name               string            `json:"name"`
-	AdminPort          uint32            `json:"adminPort,omitempty"`
-	DataplaneTokenPath string            `json:"dataplaneTokenPath,omitempty"`
-	DataplaneResource  string            `json:"dataplaneResource,omitempty"`
-	Host               string            `json:"-"`
-	Version            Version           `json:"version"`
-	DynamicMetadata    map[string]string `json:"dynamicMetadata"`
+	Mesh               string  `json:"mesh"`
+	Name               string  `json:"name"`
+	AdminPort          uint32  `json:"adminPort,omitempty"`
+	DataplaneTokenPath string  `json:"dataplaneTokenPath,omitempty"`
+	DataplaneToken     string  `json:"dataplaneToken,omitempty"`
+	DataplaneResource  string  `json:"dataplaneResource,omitempty"`
+	Host               string  `json:"-"`
+	Version            Version `json:"version"`
+	// CaCert is a PEM-encoded CA cert that DP uses to verify CP
+	CaCert          string            `json:"caCert"`
+	DynamicMetadata map[string]string `json:"dynamicMetadata"`
 	// BootstrapVersion is an optional version to override the control plane's default setting
 	BootstrapVersion BootstrapVersion `json:"bootstrapVersion"`
 }
diff --git a/pkg/xds/envoy/tls/v2/tls.go b/pkg/xds/envoy/tls/v2/tls.go
index b16abf8b6..0c001ccd1 100644
--- a/pkg/xds/envoy/tls/v2/tls.go
+++ b/pkg/xds/envoy/tls/v2/tls.go
@@ -15,6 +15,9 @@ import (
 	envoy_tls "github.com/kumahq/kuma/pkg/xds/envoy/tls"
 )
 
+// SDS is served over the same server as XDS but it has to be a separate connection because it is not server over ADS
+const sdsCluster = "ads_cluster"
+
 // CreateDownstreamTlsContext creates DownstreamTlsContext for incoming connections
 // It verifies that incoming connection has TLS certificate signed by Mesh CA with URI SAN of prefix spiffe://{mesh_name}/
 // It secures inbound listener with certificate of "identity_cert" that will be received from the SDS (it contains URI SANs of all inbounds).
@@ -86,6 +89,54 @@ func createCommonTlsContext(ctx xds_context.Context, metadata *core_xds.Dataplan
 }
 
 func sdsSecretConfig(context xds_context.Context, name string, metadata *core_xds.DataplaneMetadata) (*envoy_auth.SdsSecretConfig, error) {
+	sdsConfig := &envoy_auth.SdsSecretConfig{
+		Name: name,
+		SdsConfig: &envoy_core.ConfigSource{
+			// nolint:staticcheck
+			ResourceApiVersion: envoy_core.ApiVersion_V2,
+		},
+	}
+	if metadata.GetDataplaneTokenPath() != "" {
+		specifier, err := googleGrpcSdsSpecifier(context, name, metadata)
+		if err != nil {
+			return nil, err
+		}
+		sdsConfig.SdsConfig.ConfigSourceSpecifier = specifier
+	} else {
+		sdsConfig.SdsConfig.ConfigSourceSpecifier = envoyGrpcSdsSpecifier(metadata)
+	}
+	return sdsConfig, nil
+}
+
+func envoyGrpcSdsSpecifier(metadata *core_xds.DataplaneMetadata) *envoy_core.ConfigSource_ApiConfigSource {
+	specifier := &envoy_core.ConfigSource_ApiConfigSource{
+		ApiConfigSource: &envoy_core.ApiConfigSource{
+			ApiType: envoy_core.ApiConfigSource_GRPC,
+			// nolint:staticcheck
+			TransportApiVersion: envoy_core.ApiVersion_V2,
+			GrpcServices: []*envoy_core.GrpcService{
+				{
+					TargetSpecifier: &envoy_core.GrpcService_EnvoyGrpc_{
+						EnvoyGrpc: &envoy_core.GrpcService_EnvoyGrpc{
+							ClusterName: sdsCluster,
+						},
+					},
+				},
+			},
+		},
+	}
+	if metadata.GetDataplaneToken() != "" {
+		specifier.ApiConfigSource.GrpcServices[0].InitialMetadata = []*envoy_core.HeaderValue{
+			{
+				Key:   "authorization",
+				Value: metadata.DataplaneToken,
+			},
+		}
+	}
+	return specifier
+}
+
+func googleGrpcSdsSpecifier(context xds_context.Context, name string, metadata *core_xds.DataplaneMetadata) (*envoy_core.ConfigSource_ApiConfigSource, error) {
 	withCallCredentials := func(grpc *envoy_core.GrpcService_GoogleGrpc) (*envoy_core.GrpcService_GoogleGrpc, error) {
 		if metadata.GetDataplaneTokenPath() == "" {
 			return grpc, nil
@@ -135,18 +186,15 @@ func sdsSecretConfig(context xds_context.Context, name string, metadata *core_xd
 	if err != nil {
 		return nil, err
 	}
-	return &envoy_auth.SdsSecretConfig{
-		Name: name,
-		SdsConfig: &envoy_core.ConfigSource{
-			ConfigSourceSpecifier: &envoy_core.ConfigSource_ApiConfigSource{
-				ApiConfigSource: &envoy_core.ApiConfigSource{
-					ApiType: envoy_core.ApiConfigSource_GRPC,
-					GrpcServices: []*envoy_core.GrpcService{
-						{
-							TargetSpecifier: &envoy_core.GrpcService_GoogleGrpc_{
-								GoogleGrpc: googleGrpc,
-							},
-						},
+	return &envoy_core.ConfigSource_ApiConfigSource{
+		ApiConfigSource: &envoy_core.ApiConfigSource{
+			ApiType: envoy_core.ApiConfigSource_GRPC,
+			// nolint:staticcheck
+			TransportApiVersion: envoy_core.ApiVersion_V2,
+			GrpcServices: []*envoy_core.GrpcService{
+				{
+					TargetSpecifier: &envoy_core.GrpcService_GoogleGrpc_{
+						GoogleGrpc: googleGrpc,
 					},
 				},
 			},
diff --git a/pkg/xds/envoy/tls/v3/tls.go b/pkg/xds/envoy/tls/v3/tls.go
index e02c4ad68..ee9e040af 100644
--- a/pkg/xds/envoy/tls/v3/tls.go
+++ b/pkg/xds/envoy/tls/v3/tls.go
@@ -7,16 +7,19 @@ import (
 	envoy_type_matcher "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3"
 
 	"github.com/kumahq/kuma/pkg/tls"
+	"github.com/kumahq/kuma/pkg/util/proto"
+	util_xds "github.com/kumahq/kuma/pkg/util/xds"
 
 	"github.com/golang/protobuf/ptypes/wrappers"
 
 	core_xds "github.com/kumahq/kuma/pkg/core/xds"
-	"github.com/kumahq/kuma/pkg/util/proto"
-	util_xds "github.com/kumahq/kuma/pkg/util/xds"
 	xds_context "github.com/kumahq/kuma/pkg/xds/context"
 	xds_tls "github.com/kumahq/kuma/pkg/xds/envoy/tls"
 )
 
+// SDS is served over the same server as XDS but it has to be a separate connection because it is not server over ADS
+const sdsCluster = "ads_cluster"
+
 // CreateDownstreamTlsContext creates DownstreamTlsContext for incoming connections
 // It verifies that incoming connection has TLS certificate signed by Mesh CA with URI SAN of prefix spiffe://{mesh_name}/
 // It secures inbound listener with certificate of "identity_cert" that will be received from the SDS (it contains URI SANs of all inbounds).
@@ -88,6 +91,52 @@ func createCommonTlsContext(ctx xds_context.Context, metadata *core_xds.Dataplan
 }
 
 func sdsSecretConfig(context xds_context.Context, name string, metadata *core_xds.DataplaneMetadata) (*envoy_tls.SdsSecretConfig, error) {
+	sdsConfig := &envoy_tls.SdsSecretConfig{
+		Name: name,
+		SdsConfig: &envoy_core.ConfigSource{
+			ResourceApiVersion: envoy_core.ApiVersion_V3,
+		},
+	}
+	if metadata.GetDataplaneTokenPath() != "" {
+		specifier, err := googleGrpcSdsSpecifier(context, name, metadata)
+		if err != nil {
+			return nil, err
+		}
+		sdsConfig.SdsConfig.ConfigSourceSpecifier = specifier
+	} else {
+		sdsConfig.SdsConfig.ConfigSourceSpecifier = envoyGrpcSdsSpecifier(metadata)
+	}
+	return sdsConfig, nil
+}
+
+func envoyGrpcSdsSpecifier(metadata *core_xds.DataplaneMetadata) *envoy_core.ConfigSource_ApiConfigSource {
+	specifier := &envoy_core.ConfigSource_ApiConfigSource{
+		ApiConfigSource: &envoy_core.ApiConfigSource{
+			ApiType:             envoy_core.ApiConfigSource_GRPC,
+			TransportApiVersion: envoy_core.ApiVersion_V3,
+			GrpcServices: []*envoy_core.GrpcService{
+				{
+					TargetSpecifier: &envoy_core.GrpcService_EnvoyGrpc_{
+						EnvoyGrpc: &envoy_core.GrpcService_EnvoyGrpc{
+							ClusterName: sdsCluster,
+						},
+					},
+				},
+			},
+		},
+	}
+	if metadata.GetDataplaneToken() != "" {
+		specifier.ApiConfigSource.GrpcServices[0].InitialMetadata = []*envoy_core.HeaderValue{
+			{
+				Key:   "authorization",
+				Value: metadata.DataplaneToken,
+			},
+		}
+	}
+	return specifier
+}
+
+func googleGrpcSdsSpecifier(context xds_context.Context, name string, metadata *core_xds.DataplaneMetadata) (*envoy_core.ConfigSource_ApiConfigSource, error) {
 	withCallCredentials := func(grpc *envoy_core.GrpcService_GoogleGrpc) (*envoy_core.GrpcService_GoogleGrpc, error) {
 		if metadata.GetDataplaneTokenPath() == "" {
 			return grpc, nil
@@ -137,20 +186,14 @@ func sdsSecretConfig(context xds_context.Context, name string, metadata *core_xd
 	if err != nil {
 		return nil, err
 	}
-	return &envoy_tls.SdsSecretConfig{
-		Name: name,
-		SdsConfig: &envoy_core.ConfigSource{
-			ResourceApiVersion: envoy_core.ApiVersion_V3,
-			ConfigSourceSpecifier: &envoy_core.ConfigSource_ApiConfigSource{
-				ApiConfigSource: &envoy_core.ApiConfigSource{
-					ApiType:             envoy_core.ApiConfigSource_GRPC,
-					TransportApiVersion: envoy_core.ApiVersion_V3,
-					GrpcServices: []*envoy_core.GrpcService{
-						{
-							TargetSpecifier: &envoy_core.GrpcService_GoogleGrpc_{
-								GoogleGrpc: googleGrpc,
-							},
-						},
+	return &envoy_core.ConfigSource_ApiConfigSource{
+		ApiConfigSource: &envoy_core.ApiConfigSource{
+			ApiType:             envoy_core.ApiConfigSource_GRPC,
+			TransportApiVersion: envoy_core.ApiVersion_V3,
+			GrpcServices: []*envoy_core.GrpcService{
+				{
+					TargetSpecifier: &envoy_core.GrpcService_GoogleGrpc_{
+						GoogleGrpc: googleGrpc,
 					},
 				},
 			},


Test patch:
diff --git a/app/kuma-dp/pkg/dataplane/envoy/remote_bootstrap_test.go b/app/kuma-dp/pkg/dataplane/envoy/remote_bootstrap_test.go
index d9bcb2107..5a06a3804 100644
--- a/app/kuma-dp/pkg/dataplane/envoy/remote_bootstrap_test.go
+++ b/app/kuma-dp/pkg/dataplane/envoy/remote_bootstrap_test.go
@@ -88,7 +88,7 @@ var _ = Describe("Remote Bootstrap", func() {
 				cfg.Dataplane.Mesh = "demo"
 				cfg.Dataplane.Name = "sample"
 				cfg.Dataplane.AdminPort = config_types.MustExactPort(4321) // exact port
-				cfg.DataplaneRuntime.TokenPath = "/tmp/token"
+				cfg.DataplaneRuntime.Token = "token"
 
 				return testCase{
 					config:           cfg,
@@ -108,7 +108,7 @@ var _ = Describe("Remote Bootstrap", func() {
 					  "mesh": "demo",
 					  "name": "sample",
 					  "adminPort": 4321,
-					  "dataplaneTokenPath": "/tmp/token",
+					  "dataplaneToken": "token",
 					  "dataplaneResource": "{\"type\":\"Dataplane\",\"mesh\":\"demo\",\"name\":\"sample\",\"creationTime\":\"0001-01-01T00:00:00Z\",\"modificationTime\":\"0001-01-01T00:00:00Z\"}",
 					  "version": {
 						"kumaDp": {
@@ -122,6 +122,7 @@ var _ = Describe("Remote Bootstrap", func() {
 						  "build": "hash/1.15.0/RELEASE"
 						}
 					  },
+					  "caCert": "",
 					  "bootstrapVersion": "2",
 					  "dynamicMetadata": {
 					    "test": "value"
@@ -136,7 +137,7 @@ var _ = Describe("Remote Bootstrap", func() {
 				cfg.Dataplane.Mesh = "demo"
 				cfg.Dataplane.Name = "sample"
 				cfg.Dataplane.AdminPort = config_types.MustPortRange(4321, 8765) // port range
-				cfg.DataplaneRuntime.TokenPath = "/tmp/token"
+				cfg.DataplaneRuntime.Token = "token"
 
 				return testCase{
 					config: cfg,
@@ -153,7 +154,7 @@ var _ = Describe("Remote Bootstrap", func() {
                       "mesh": "demo",
                       "name": "sample",
                       "adminPort": 4321,
-                      "dataplaneTokenPath": "/tmp/token",
+                      "dataplaneToken": "token",
                       "dataplaneResource": "{\"type\":\"Dataplane\",\"mesh\":\"demo\",\"name\":\"sample\",\"creationTime\":\"0001-01-01T00:00:00Z\",\"modificationTime\":\"0001-01-01T00:00:00Z\"}",
                       "version": {
                         "kumaDp": {
@@ -167,6 +168,7 @@ var _ = Describe("Remote Bootstrap", func() {
                           "build": "hash/1.15.0/RELEASE"
                         }
                       },
+                      "caCert": "",
                       "bootstrapVersion": "3",
 					  "dynamicMetadata": null
                     }`,
@@ -178,7 +180,7 @@ var _ = Describe("Remote Bootstrap", func() {
 				cfg.Dataplane.Mesh = "demo"
 				cfg.Dataplane.Name = "sample"
 				cfg.Dataplane.AdminPort = config_types.PortRange{} // empty port range
-				cfg.DataplaneRuntime.TokenPath = "/tmp/token"
+				cfg.DataplaneRuntime.Token = "token"
 
 				return testCase{
 					config: cfg,
@@ -193,7 +195,7 @@ var _ = Describe("Remote Bootstrap", func() {
                     {
                       "mesh": "demo",
                       "name": "sample",
-                      "dataplaneTokenPath": "/tmp/token",
+                      "dataplaneToken": "token",
                       "dataplaneResource": "{\"type\":\"Dataplane\",\"mesh\":\"demo\",\"name\":\"sample\",\"creationTime\":\"0001-01-01T00:00:00Z\",\"modificationTime\":\"0001-01-01T00:00:00Z\"}",
                       "version": {
                         "kumaDp": {
@@ -207,6 +209,7 @@ var _ = Describe("Remote Bootstrap", func() {
                           "build": "hash/1.15.0/RELEASE"
                         }
                       },
+                      "caCert": "",
                       "bootstrapVersion": "",
 					  "dynamicMetadata": null
                     }`,
@@ -288,6 +291,6 @@ var _ = Describe("Remote Bootstrap", func() {
 		_, _, err = generator(fmt.Sprintf("http://localhost:%d", port), config, params)
 
 		// then
-		Expect(err).To(MatchError("retryable: Dataplane entity not found. If you are running on Universal please create a Dataplane entity on kuma-cp before starting kuma-dp. If you are running on Kubernetes, please check the kuma-cp logs to determine why the Dataplane entity could not be created by the automatic sidecar injection."))
+		Expect(err).To(MatchError("retryable: Dataplane entity not found. If you are running on Universal please create a Dataplane entity on kuma-cp before starting kuma-dp or pass it to kuma-dp run --dataplane-file=/file. If you are running on Kubernetes, please check the kuma-cp logs to determine why the Dataplane entity could not be created by the automatic sidecar injection."))
 	})
 })
diff --git a/pkg/xds/bootstrap/generator_test.go b/pkg/xds/bootstrap/generator_test.go
index b92506958..5b184535d 100644
--- a/pkg/xds/bootstrap/generator_test.go
+++ b/pkg/xds/bootstrap/generator_test.go
@@ -137,11 +137,11 @@ var _ = Describe("bootstrapGenerator", func() {
 				return cfg
 			},
 			request: types.BootstrapRequest{
-				Mesh:               "mesh",
-				Name:               "name.namespace",
-				AdminPort:          1234,
-				DataplaneTokenPath: "/tmp/token",
-				Version:            defaultVersion,
+				Mesh:           "mesh",
+				Name:           "name.namespace",
+				AdminPort:      1234,
+				DataplaneToken: "token",
+				Version:        defaultVersion,
 			},
 			expectedConfigFile:       "generator.default-config.golden.yaml",
 			expectedBootstrapVersion: types.BootstrapV3,
@@ -368,50 +368,91 @@ var _ = Describe("bootstrapGenerator", func() {
 		Expect(err.Error()).To(Equal("Resource precondition failed: Port 9901 requested as both admin and outbound port."))
 	})
 
-	It("should fail bootstrap due to invalid hostname", func() {
-		// given
-		cfg := bootstrap_config.DefaultBootstrapServerConfig()
+	type errTestCase struct {
+		request  types.BootstrapRequest
+		expected string
+	}
+	DescribeTable("should fail bootstrap",
+		func(given errTestCase) {
+			// given
+			cfg := bootstrap_config.DefaultBootstrapServerConfig()
 
-		generator, err := NewDefaultBootstrapGenerator(resManager, cfg, filepath.Join("..", "..", "..", "test", "certs", "server-cert.pem"), false, true)
-		Expect(err).ToNot(HaveOccurred())
-		request := types.BootstrapRequest{
-			Mesh:      "mesh",
-			Name:      "name-3.namespace",
-			AdminPort: 9901,
-			Host:      "kuma.internal",
-		}
+			generator, err := NewDefaultBootstrapGenerator(resManager, cfg, filepath.Join("..", "..", "..", "test", "certs", "server-cert.pem"), false, true)
+			Expect(err).ToNot(HaveOccurred())
 
-		// when
-		_, _, err = generator.Generate(context.Background(), request)
-		// then
-		Expect(err).To(HaveOccurred())
-		// and
-		Expect(err.Error()).To(Equal(`A data plane proxy is trying to connect to the control plane using "kuma.internal" address, but the certificate in the control plane has the following SANs ["localhost"]. Either change the --cp-address in kuma-dp to one of those or execute the following steps:
+			// when
+			_, _, err = generator.Generate(context.Background(), given.request)
+			// then
+			Expect(err).To(HaveOccurred())
+			// and
+			Expect(err.Error()).To(Equal(given.expected))
+		},
+		Entry("due to invalid hostname", errTestCase{
+			request: types.BootstrapRequest{
+				Mesh:      "mesh",
+				Name:      "name-3.namespace",
+				AdminPort: 9901,
+				Host:      "kuma.internal",
+			},
+			expected: `A data plane proxy is trying to connect to the control plane using "kuma.internal" address, but the certificate in the control plane has the following SANs ["localhost"]. Either change the --cp-address in kuma-dp to one of those or execute the following steps:
 1) Generate a new certificate with the address you are trying to use. It is recommended to use trusted Certificate Authority, but you can also generate self-signed certificates using 'kumactl generate tls-certificate --type=server --cp-hostname=kuma.internal'
 2) Set KUMA_GENERAL_TLS_CERT_FILE and KUMA_GENERAL_TLS_KEY_FILE or the equivalent in Kuma CP config file to the new certificate.
-3) Restart the control plane to read the new certificate and start kuma-dp.`))
-	})
-
-	It("should fail bootstrap due to invalid bootstrap version", func() {
-		// given
-		cfg := bootstrap_config.DefaultBootstrapServerConfig()
-		cfg.Params.XdsHost = "localhost"
-		cfg.Params.XdsPort = 5678
-
-		generator, err := NewDefaultBootstrapGenerator(resManager, cfg, filepath.Join("..", "..", "..", "test", "certs", "server-cert.pem"), false, true)
-		Expect(err).ToNot(HaveOccurred())
-		request := types.BootstrapRequest{
-			Mesh:             "mesh",
-			Name:             "name.namespace",
-			AdminPort:        9901,
-			BootstrapVersion: "5",
-		}
-
-		// when
-		_, _, err = generator.Generate(context.Background(), request)
-		// then
-		Expect(err).To(HaveOccurred())
-		// and
-		Expect(err.Error()).To(Equal(`Invalid BootstrapVersion. Available values are: "2", "3"`))
-	})
+3) Restart the control plane to read the new certificate and start kuma-dp.`,
+		}),
+		Entry("due to invalid bootstrap version", errTestCase{
+			request: types.BootstrapRequest{
+				Host:             "localhost",
+				Mesh:             "mesh",
+				Name:             "name.namespace",
+				AdminPort:        9901,
+				BootstrapVersion: "5",
+			},
+			expected: `Invalid BootstrapVersion. Available values are: "2", "3"`,
+		}),
+		Entry("when both dataplane and dataplane token path are defined", errTestCase{
+			request: types.BootstrapRequest{
+				Host:               "localhost",
+				Mesh:               "mesh",
+				Name:               "name.namespace",
+				AdminPort:          9901,
+				DataplaneTokenPath: "/tmp",
+				DataplaneToken:     "token",
+			},
+			expected: `dataplaneToken: only one of dataplaneToken and dataplaneTokenField can be defined`,
+		}),
+		Entry("when CaCert is not a CA and EnvoyGRPC is used", errTestCase{
+			request: types.BootstrapRequest{
+				Host:           "localhost",
+				Mesh:           "mesh",
+				Name:           "name.namespace",
+				AdminPort:      9901,
+				DataplaneToken: "token",
+				CaCert: `
+-----BEGIN CERTIFICATE-----
+MIIDdzCCAl+gAwIBAgIJAPHcHHoejP+XMA0GCSqGSIb3DQEBCwUAMD4xCzAJBgNV
+BAYTAlBMMQ8wDQYDVQQIDAZXYXJzYXcxDzANBgNVBAcMBldhcnNhdzENMAsGA1UE
+CgwES29uZzAeFw0yMTAzMzAwOTEwMTFaFw0yMzA3MDMwOTEwMTFaMC8xCzAJBgNV
+BAYTAlBMMQ8wDQYDVQQIDAZXYXJzYXcxDzANBgNVBAcMBldhcnNhdzCCASIwDQYJ
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBAMOxLuQiRSsDKb+E/iliMN0ME1ENxx6v
+S362cmyL6pCS6HdsJnOiCeAiiezRdotf7pD87DkwLrAI2v6IOEueXmXu/pRkZZdj
+GFdYOJ0j28Qg79VfhLZPGZrATowUkmNfWFuX7gyjButP5+M6yMEm8piKkMgYtj8H
+13Jj5GBazYojBdVkdC7VCRjwiF3oudDC+I0f5RFwqrU89zfLf8fIYn0waioUZKT9
+W48oVmRw2SqYFf5O+T+EY3mcSWRNrzweZX7YdFvHFJLSglkmn7275cdwqle68iZn
+xbVn7MW5nlp5W0ONAFLB3JJ7TRee2o8P9CkiuqG+ppmMPQq5zWPGuxUCAwEAAaOB
+hjCBgzBYBgNVHSMEUTBPoUKkQDA+MQswCQYDVQQGEwJQTDEPMA0GA1UECAwGV2Fy
+c2F3MQ8wDQYDVQQHDAZXYXJzYXcxDTALBgNVBAoMBEtvbmeCCQDpKl9mxhgHFzAJ
+BgNVHRMEAjAAMAsGA1UdDwQEAwIE8DAPBgNVHREECDAGhwTAqAANMA0GCSqGSIb3
+DQEBCwUAA4IBAQCHU5JyuMwayeVBVSOnGw8A9ugrGfyHy4nN+vK+IjkyPaDynyob
+i1mXzK1JDn2koHqRRlSGQGy/eJdHRPxUj8+VzyIbCVqpiiOYxC2tQUQ5BhVGC08u
+oCZcflyypSej2QVYtj83ty8ty1EFSdO8v23oPhzVSjc+SkF5c+q326piXf+a5wWh
+uAxW1XJnTaqAFhGR9c0zRCrbz86yQTsdFAm1UVMMucnZjNpWL4pHLJC6FCiOO17q
+w/vjIriD0mGwwccxbojmEHq4rO4ZrjQNmwvOgxoL2dTm/L9Smr6RXmIgu/0Pnrlq
+7RLK1pnDttr4brFafbIvWIBvshe2hoCT6jBW
+-----END CERTIFICATE-----
+`,
+			},
+			expected: `A data plane proxy is trying to verify the control plane using the certificate which is not a certificate authority (basic constraint 'CA' is set to 'false').
+Provide CA that was used to sign a certificate used in the control plane by using 'kuma-dp run --ca-cert-file=file' or via KUMA_CONTROL_PLANE_CA_CERT_FILE`,
+		}),
+	)
 })
diff --git a/pkg/xds/bootstrap/testdata/bootstrap.k8s.golden.yaml b/pkg/xds/bootstrap/testdata/bootstrap.k8s.golden.yaml
index 5e6f679a8..5982d57fe 100644
--- a/pkg/xds/bootstrap/testdata/bootstrap.k8s.golden.yaml
+++ b/pkg/xds/bootstrap/testdata/bootstrap.k8s.golden.yaml
@@ -74,6 +74,34 @@ staticResources:
     type: STATIC
     upstreamConnectionOptions:
       tcpKeepalive: {}
+  - connectTimeout: 1s
+    http2ProtocolOptions: {}
+    loadAssignment:
+      clusterName: ads_cluster
+      endpoints:
+      - lbEndpoints:
+        - endpoint:
+            address:
+              socketAddress:
+                address: localhost
+                portValue: 5678
+    name: ads_cluster
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        commonTlsContext:
+          tlsParams:
+            tlsMinimumProtocolVersion: TLSv1_2
+          validationContext:
+            matchSubjectAltNames:
+            - exact: localhost
+            trustedCa:
+              inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMRENDQWhTZ0F3SUJBZ0lRSGRQaHhPZlhnV3VOeG9GbFYvRXdxVEFOQmdrcWhraUc5dzBCQVFzRkFEQVAKTVEwd0N3WURWUVFERXdScmRXMWhNQjRYRFRJd01Ea3hOakV5TWpnME5Gb1hEVE13TURreE5ERXlNamcwTkZvdwpEekVOTUFzR0ExVUVBeE1FYTNWdFlUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCCkFPWkdiV2hTbFFTUnhGTnQ1cC8yV0NLRnlIWjNDdXdOZ3lMRVA3blM0Wlh5a3hzRmJZU3VWM2JJZ0Y3YlQvdXEKYTVRaXJlK0M2MGd1aEZicExjUGgyWjZVZmdJZDY5R2xRekhNVlljbUxHalZRdXlBdDRGTU1rVGZWRWw1STRPYQorMml0M0J2aWhWa0toVXo4eTVSUjVLYnFKZkdwNFoyMEZoNmZ0dG9DRmJlT0RtdkJzWUpGbVVRUytpZm95TVkvClAzUjAzU3U3ZzVpSXZuejd0bWt5ZG9OQzhuR1JEemRENUM4Zkp2clZJMVVYNkpSR3lMS3Q0NW9RWHQxbXhLMTAKNUthTjJ6TlYyV3RIc2FKcDlid3JQSCtKaVpHZVp5dnVoNVV3ckxkSENtcUs3c205VG9kR3p0VVpZMFZ6QWM0cQprWVZpWFk4Z1VqZk5tK2NRclBPMWtOOENBd0VBQWFPQmd6Q0JnREFPQmdOVkhROEJBZjhFQkFNQ0FxUXdIUVlEClZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQk1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWUQKVlIwT0JCWUVGR01EQlBQaUJGSjNtdjJvQTlDVHFqZW1GVFYyTUI4R0ExVWRFUVFZTUJhQ0NXeHZZMkZzYUc5egpkSUlKYkc5allXeG9iM04wTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDLzE3UXdlT3BHZGIxTUVCSjhYUEc3CjNzSy91dG9XTFgxdGpmOFN1MURnYTZDRFQvZVRXSFpyV1JmODFLT1ZZMDdkbGU1U1JJREsxUWhmYkdHdEZQK1QKdlprcm9vdXNJOVVTMmFDV2xrZUNaV0dUbnF2TG1Eb091anFhZ0RvS1JSdWs0bVFkdE5Ob254aUwvd1p0VEZLaQorMWlOalVWYkxXaURYZEJMeG9SSVZkTE96cWIvTU54d0VsVXlhVERBa29wUXlPV2FURGtZUHJHbWFXamNzZlBHCmFPS293MHplK3pIVkZxVEhiam5DcUVWM2huc1V5UlV3c0JsbjkrakRKWGd3Wk0vdE1sVkpyWkNoMFNsZTlZNVoKTU9CMGZDZjZzVE1OUlRHZzVMcGw2dUlZTS81SU5wbUhWTW8zbjdNQlNucEVEQVVTMmJmL3VvNWdJaXE2WENkcAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        sni: localhost
+    type: STRICT_DNS
+    upstreamConnectionOptions:
+      tcpKeepalive: {}
 statsConfig:
   statsTags:
   - regex: ^grpc\.((.+)\.)
diff --git a/pkg/xds/bootstrap/testdata/bootstrap.overridden.golden.yaml b/pkg/xds/bootstrap/testdata/bootstrap.overridden.golden.yaml
index 7afe01d38..bf93bd06b 100644
--- a/pkg/xds/bootstrap/testdata/bootstrap.overridden.golden.yaml
+++ b/pkg/xds/bootstrap/testdata/bootstrap.overridden.golden.yaml
@@ -81,6 +81,34 @@ staticResources:
     type: STATIC
     upstreamConnectionOptions:
       tcpKeepalive: {}
+  - connectTimeout: 1s
+    http2ProtocolOptions: {}
+    loadAssignment:
+      clusterName: ads_cluster
+      endpoints:
+      - lbEndpoints:
+        - endpoint:
+            address:
+              socketAddress:
+                address: localhost
+                portValue: 5678
+    name: ads_cluster
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        commonTlsContext:
+          tlsParams:
+            tlsMinimumProtocolVersion: TLSv1_2
+          validationContext:
+            matchSubjectAltNames:
+            - exact: localhost
+            trustedCa:
+              inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMRENDQWhTZ0F3SUJBZ0lRSGRQaHhPZlhnV3VOeG9GbFYvRXdxVEFOQmdrcWhraUc5dzBCQVFzRkFEQVAKTVEwd0N3WURWUVFERXdScmRXMWhNQjRYRFRJd01Ea3hOakV5TWpnME5Gb1hEVE13TURreE5ERXlNamcwTkZvdwpEekVOTUFzR0ExVUVBeE1FYTNWdFlUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCCkFPWkdiV2hTbFFTUnhGTnQ1cC8yV0NLRnlIWjNDdXdOZ3lMRVA3blM0Wlh5a3hzRmJZU3VWM2JJZ0Y3YlQvdXEKYTVRaXJlK0M2MGd1aEZicExjUGgyWjZVZmdJZDY5R2xRekhNVlljbUxHalZRdXlBdDRGTU1rVGZWRWw1STRPYQorMml0M0J2aWhWa0toVXo4eTVSUjVLYnFKZkdwNFoyMEZoNmZ0dG9DRmJlT0RtdkJzWUpGbVVRUytpZm95TVkvClAzUjAzU3U3ZzVpSXZuejd0bWt5ZG9OQzhuR1JEemRENUM4Zkp2clZJMVVYNkpSR3lMS3Q0NW9RWHQxbXhLMTAKNUthTjJ6TlYyV3RIc2FKcDlid3JQSCtKaVpHZVp5dnVoNVV3ckxkSENtcUs3c205VG9kR3p0VVpZMFZ6QWM0cQprWVZpWFk4Z1VqZk5tK2NRclBPMWtOOENBd0VBQWFPQmd6Q0JnREFPQmdOVkhROEJBZjhFQkFNQ0FxUXdIUVlEClZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQk1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWUQKVlIwT0JCWUVGR01EQlBQaUJGSjNtdjJvQTlDVHFqZW1GVFYyTUI4R0ExVWRFUVFZTUJhQ0NXeHZZMkZzYUc5egpkSUlKYkc5allXeG9iM04wTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDLzE3UXdlT3BHZGIxTUVCSjhYUEc3CjNzSy91dG9XTFgxdGpmOFN1MURnYTZDRFQvZVRXSFpyV1JmODFLT1ZZMDdkbGU1U1JJREsxUWhmYkdHdEZQK1QKdlprcm9vdXNJOVVTMmFDV2xrZUNaV0dUbnF2TG1Eb091anFhZ0RvS1JSdWs0bVFkdE5Ob254aUwvd1p0VEZLaQorMWlOalVWYkxXaURYZEJMeG9SSVZkTE96cWIvTU54d0VsVXlhVERBa29wUXlPV2FURGtZUHJHbWFXamNzZlBHCmFPS293MHplK3pIVkZxVEhiam5DcUVWM2huc1V5UlV3c0JsbjkrakRKWGd3Wk0vdE1sVkpyWkNoMFNsZTlZNVoKTU9CMGZDZjZzVE1OUlRHZzVMcGw2dUlZTS81SU5wbUhWTW8zbjdNQlNucEVEQVVTMmJmL3VvNWdJaXE2WENkcAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        sni: localhost
+    type: STRICT_DNS
+    upstreamConnectionOptions:
+      tcpKeepalive: {}
 statsConfig:
   statsTags:
   - regex: ^grpc\.((.+)\.)
diff --git a/pkg/xds/bootstrap/testdata/bootstrap.universal.golden.yaml b/pkg/xds/bootstrap/testdata/bootstrap.universal.golden.yaml
index e86ac6039..c7696fdae 100644
--- a/pkg/xds/bootstrap/testdata/bootstrap.universal.golden.yaml
+++ b/pkg/xds/bootstrap/testdata/bootstrap.universal.golden.yaml
@@ -74,6 +74,34 @@ staticResources:
     type: STATIC
     upstreamConnectionOptions:
       tcpKeepalive: {}
+  - connectTimeout: 1s
+    http2ProtocolOptions: {}
+    loadAssignment:
+      clusterName: ads_cluster
+      endpoints:
+      - lbEndpoints:
+        - endpoint:
+            address:
+              socketAddress:
+                address: localhost
+                portValue: 5678
+    name: ads_cluster
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        commonTlsContext:
+          tlsParams:
+            tlsMinimumProtocolVersion: TLSv1_2
+          validationContext:
+            matchSubjectAltNames:
+            - exact: localhost
+            trustedCa:
+              inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMRENDQWhTZ0F3SUJBZ0lRSGRQaHhPZlhnV3VOeG9GbFYvRXdxVEFOQmdrcWhraUc5dzBCQVFzRkFEQVAKTVEwd0N3WURWUVFERXdScmRXMWhNQjRYRFRJd01Ea3hOakV5TWpnME5Gb1hEVE13TURreE5ERXlNamcwTkZvdwpEekVOTUFzR0ExVUVBeE1FYTNWdFlUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCCkFPWkdiV2hTbFFTUnhGTnQ1cC8yV0NLRnlIWjNDdXdOZ3lMRVA3blM0Wlh5a3hzRmJZU3VWM2JJZ0Y3YlQvdXEKYTVRaXJlK0M2MGd1aEZicExjUGgyWjZVZmdJZDY5R2xRekhNVlljbUxHalZRdXlBdDRGTU1rVGZWRWw1STRPYQorMml0M0J2aWhWa0toVXo4eTVSUjVLYnFKZkdwNFoyMEZoNmZ0dG9DRmJlT0RtdkJzWUpGbVVRUytpZm95TVkvClAzUjAzU3U3ZzVpSXZuejd0bWt5ZG9OQzhuR1JEemRENUM4Zkp2clZJMVVYNkpSR3lMS3Q0NW9RWHQxbXhLMTAKNUthTjJ6TlYyV3RIc2FKcDlid3JQSCtKaVpHZVp5dnVoNVV3ckxkSENtcUs3c205VG9kR3p0VVpZMFZ6QWM0cQprWVZpWFk4Z1VqZk5tK2NRclBPMWtOOENBd0VBQWFPQmd6Q0JnREFPQmdOVkhROEJBZjhFQkFNQ0FxUXdIUVlEClZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQk1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWUQKVlIwT0JCWUVGR01EQlBQaUJGSjNtdjJvQTlDVHFqZW1GVFYyTUI4R0ExVWRFUVFZTUJhQ0NXeHZZMkZzYUc5egpkSUlKYkc5allXeG9iM04wTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDLzE3UXdlT3BHZGIxTUVCSjhYUEc3CjNzSy91dG9XTFgxdGpmOFN1MURnYTZDRFQvZVRXSFpyV1JmODFLT1ZZMDdkbGU1U1JJREsxUWhmYkdHdEZQK1QKdlprcm9vdXNJOVVTMmFDV2xrZUNaV0dUbnF2TG1Eb091anFhZ0RvS1JSdWs0bVFkdE5Ob254aUwvd1p0VEZLaQorMWlOalVWYkxXaURYZEJMeG9SSVZkTE96cWIvTU54d0VsVXlhVERBa29wUXlPV2FURGtZUHJHbWFXamNzZlBHCmFPS293MHplK3pIVkZxVEhiam5DcUVWM2huc1V5UlV3c0JsbjkrakRKWGd3Wk0vdE1sVkpyWkNoMFNsZTlZNVoKTU9CMGZDZjZzVE1OUlRHZzVMcGw2dUlZTS81SU5wbUhWTW8zbjdNQlNucEVEQVVTMmJmL3VvNWdJaXE2WENkcAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        sni: localhost
+    type: STRICT_DNS
+    upstreamConnectionOptions:
+      tcpKeepalive: {}
 statsConfig:
   statsTags:
   - regex: ^grpc\.((.+)\.)
diff --git a/pkg/xds/bootstrap/testdata/generator.custom-config-minimal-request.golden.yaml b/pkg/xds/bootstrap/testdata/generator.custom-config-minimal-request.golden.yaml
index 374130dac..138203fcd 100644
--- a/pkg/xds/bootstrap/testdata/generator.custom-config-minimal-request.golden.yaml
+++ b/pkg/xds/bootstrap/testdata/generator.custom-config-minimal-request.golden.yaml
@@ -8,13 +8,8 @@ dynamicResources:
   adsConfig:
     apiType: GRPC
     grpcServices:
-    - googleGrpc:
-        channelCredentials:
-          sslCredentials:
-            rootCerts:
-              inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMRENDQWhTZ0F3SUJBZ0lRSGRQaHhPZlhnV3VOeG9GbFYvRXdxVEFOQmdrcWhraUc5dzBCQVFzRkFEQVAKTVEwd0N3WURWUVFERXdScmRXMWhNQjRYRFRJd01Ea3hOakV5TWpnME5Gb1hEVE13TURreE5ERXlNamcwTkZvdwpEekVOTUFzR0ExVUVBeE1FYTNWdFlUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCCkFPWkdiV2hTbFFTUnhGTnQ1cC8yV0NLRnlIWjNDdXdOZ3lMRVA3blM0Wlh5a3hzRmJZU3VWM2JJZ0Y3YlQvdXEKYTVRaXJlK0M2MGd1aEZicExjUGgyWjZVZmdJZDY5R2xRekhNVlljbUxHalZRdXlBdDRGTU1rVGZWRWw1STRPYQorMml0M0J2aWhWa0toVXo4eTVSUjVLYnFKZkdwNFoyMEZoNmZ0dG9DRmJlT0RtdkJzWUpGbVVRUytpZm95TVkvClAzUjAzU3U3ZzVpSXZuejd0bWt5ZG9OQzhuR1JEemRENUM4Zkp2clZJMVVYNkpSR3lMS3Q0NW9RWHQxbXhLMTAKNUthTjJ6TlYyV3RIc2FKcDlid3JQSCtKaVpHZVp5dnVoNVV3ckxkSENtcUs3c205VG9kR3p0VVpZMFZ6QWM0cQprWVZpWFk4Z1VqZk5tK2NRclBPMWtOOENBd0VBQWFPQmd6Q0JnREFPQmdOVkhROEJBZjhFQkFNQ0FxUXdIUVlEClZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQk1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWUQKVlIwT0JCWUVGR01EQlBQaUJGSjNtdjJvQTlDVHFqZW1GVFYyTUI4R0ExVWRFUVFZTUJhQ0NXeHZZMkZzYUc5egpkSUlKYkc5allXeG9iM04wTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDLzE3UXdlT3BHZGIxTUVCSjhYUEc3CjNzSy91dG9XTFgxdGpmOFN1MURnYTZDRFQvZVRXSFpyV1JmODFLT1ZZMDdkbGU1U1JJREsxUWhmYkdHdEZQK1QKdlprcm9vdXNJOVVTMmFDV2xrZUNaV0dUbnF2TG1Eb091anFhZ0RvS1JSdWs0bVFkdE5Ob254aUwvd1p0VEZLaQorMWlOalVWYkxXaURYZEJMeG9SSVZkTE96cWIvTU54d0VsVXlhVERBa29wUXlPV2FURGtZUHJHbWFXamNzZlBHCmFPS293MHplK3pIVkZxVEhiam5DcUVWM2huc1V5UlV3c0JsbjkrakRKWGd3Wk0vdE1sVkpyWkNoMFNsZTlZNVoKTU9CMGZDZjZzVE1OUlRHZzVMcGw2dUlZTS81SU5wbUhWTW8zbjdNQlNucEVEQVVTMmJmL3VvNWdJaXE2WENkcAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-        statPrefix: ads
-        targetUri: localhost:15678
+    - envoyGrpc:
+        clusterName: ads_cluster
     transportApiVersion: V2
   cdsConfig:
     ads: {}
@@ -23,13 +18,8 @@ dynamicResources:
 hdsConfig:
   apiType: GRPC
   grpcServices:
-  - googleGrpc:
-      channelCredentials:
-        sslCredentials:
-          rootCerts:
-            inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMRENDQWhTZ0F3SUJBZ0lRSGRQaHhPZlhnV3VOeG9GbFYvRXdxVEFOQmdrcWhraUc5dzBCQVFzRkFEQVAKTVEwd0N3WURWUVFERXdScmRXMWhNQjRYRFRJd01Ea3hOakV5TWpnME5Gb1hEVE13TURreE5ERXlNamcwTkZvdwpEekVOTUFzR0ExVUVBeE1FYTNWdFlUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCCkFPWkdiV2hTbFFTUnhGTnQ1cC8yV0NLRnlIWjNDdXdOZ3lMRVA3blM0Wlh5a3hzRmJZU3VWM2JJZ0Y3YlQvdXEKYTVRaXJlK0M2MGd1aEZicExjUGgyWjZVZmdJZDY5R2xRekhNVlljbUxHalZRdXlBdDRGTU1rVGZWRWw1STRPYQorMml0M0J2aWhWa0toVXo4eTVSUjVLYnFKZkdwNFoyMEZoNmZ0dG9DRmJlT0RtdkJzWUpGbVVRUytpZm95TVkvClAzUjAzU3U3ZzVpSXZuejd0bWt5ZG9OQzhuR1JEemRENUM4Zkp2clZJMVVYNkpSR3lMS3Q0NW9RWHQxbXhLMTAKNUthTjJ6TlYyV3RIc2FKcDlid3JQSCtKaVpHZVp5dnVoNVV3ckxkSENtcUs3c205VG9kR3p0VVpZMFZ6QWM0cQprWVZpWFk4Z1VqZk5tK2NRclBPMWtOOENBd0VBQWFPQmd6Q0JnREFPQmdOVkhROEJBZjhFQkFNQ0FxUXdIUVlEClZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQk1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWUQKVlIwT0JCWUVGR01EQlBQaUJGSjNtdjJvQTlDVHFqZW1GVFYyTUI4R0ExVWRFUVFZTUJhQ0NXeHZZMkZzYUc5egpkSUlKYkc5allXeG9iM04wTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDLzE3UXdlT3BHZGIxTUVCSjhYUEc3CjNzSy91dG9XTFgxdGpmOFN1MURnYTZDRFQvZVRXSFpyV1JmODFLT1ZZMDdkbGU1U1JJREsxUWhmYkdHdEZQK1QKdlprcm9vdXNJOVVTMmFDV2xrZUNaV0dUbnF2TG1Eb091anFhZ0RvS1JSdWs0bVFkdE5Ob254aUwvd1p0VEZLaQorMWlOalVWYkxXaURYZEJMeG9SSVZkTE96cWIvTU54d0VsVXlhVERBa29wUXlPV2FURGtZUHJHbWFXamNzZlBHCmFPS293MHplK3pIVkZxVEhiam5DcUVWM2huc1V5UlV3c0JsbjkrakRKWGd3Wk0vdE1sVkpyWkNoMFNsZTlZNVoKTU9CMGZDZjZzVE1OUlRHZzVMcGw2dUlZTS81SU5wbUhWTW8zbjdNQlNucEVEQVVTMmJmL3VvNWdJaXE2WENkcAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-      statPrefix: hds
-      targetUri: localhost:15678
+  - envoyGrpc:
+      clusterName: ads_cluster
   setNodeOnFirstMessageOnly: true
   transportApiVersion: V3
 node:
@@ -62,6 +52,34 @@ staticResources:
     type: STATIC
     upstreamConnectionOptions:
       tcpKeepalive: {}
+  - connectTimeout: 2s
+    http2ProtocolOptions: {}
+    loadAssignment:
+      clusterName: ads_cluster
+      endpoints:
+      - lbEndpoints:
+        - endpoint:
+            address:
+              socketAddress:
+                address: localhost
+                portValue: 15678
+    name: ads_cluster
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext
+        commonTlsContext:
+          tlsParams:
+            tlsMinimumProtocolVersion: TLSv1_2
+          validationContext:
+            matchSubjectAltNames:
+            - exact: localhost
+            trustedCa:
+              inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMRENDQWhTZ0F3SUJBZ0lRSGRQaHhPZlhnV3VOeG9GbFYvRXdxVEFOQmdrcWhraUc5dzBCQVFzRkFEQVAKTVEwd0N3WURWUVFERXdScmRXMWhNQjRYRFRJd01Ea3hOakV5TWpnME5Gb1hEVE13TURreE5ERXlNamcwTkZvdwpEekVOTUFzR0ExVUVBeE1FYTNWdFlUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCCkFPWkdiV2hTbFFTUnhGTnQ1cC8yV0NLRnlIWjNDdXdOZ3lMRVA3blM0Wlh5a3hzRmJZU3VWM2JJZ0Y3YlQvdXEKYTVRaXJlK0M2MGd1aEZicExjUGgyWjZVZmdJZDY5R2xRekhNVlljbUxHalZRdXlBdDRGTU1rVGZWRWw1STRPYQorMml0M0J2aWhWa0toVXo4eTVSUjVLYnFKZkdwNFoyMEZoNmZ0dG9DRmJlT0RtdkJzWUpGbVVRUytpZm95TVkvClAzUjAzU3U3ZzVpSXZuejd0bWt5ZG9OQzhuR1JEemRENUM4Zkp2clZJMVVYNkpSR3lMS3Q0NW9RWHQxbXhLMTAKNUthTjJ6TlYyV3RIc2FKcDlid3JQSCtKaVpHZVp5dnVoNVV3ckxkSENtcUs3c205VG9kR3p0VVpZMFZ6QWM0cQprWVZpWFk4Z1VqZk5tK2NRclBPMWtOOENBd0VBQWFPQmd6Q0JnREFPQmdOVkhROEJBZjhFQkFNQ0FxUXdIUVlEClZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQk1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWUQKVlIwT0JCWUVGR01EQlBQaUJGSjNtdjJvQTlDVHFqZW1GVFYyTUI4R0ExVWRFUVFZTUJhQ0NXeHZZMkZzYUc5egpkSUlKYkc5allXeG9iM04wTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDLzE3UXdlT3BHZGIxTUVCSjhYUEc3CjNzSy91dG9XTFgxdGpmOFN1MURnYTZDRFQvZVRXSFpyV1JmODFLT1ZZMDdkbGU1U1JJREsxUWhmYkdHdEZQK1QKdlprcm9vdXNJOVVTMmFDV2xrZUNaV0dUbnF2TG1Eb091anFhZ0RvS1JSdWs0bVFkdE5Ob254aUwvd1p0VEZLaQorMWlOalVWYkxXaURYZEJMeG9SSVZkTE96cWIvTU54d0VsVXlhVERBa29wUXlPV2FURGtZUHJHbWFXamNzZlBHCmFPS293MHplK3pIVkZxVEhiam5DcUVWM2huc1V5UlV3c0JsbjkrakRKWGd3Wk0vdE1sVkpyWkNoMFNsZTlZNVoKTU9CMGZDZjZzVE1OUlRHZzVMcGw2dUlZTS81SU5wbUhWTW8zbjdNQlNucEVEQVVTMmJmL3VvNWdJaXE2WENkcAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        sni: localhost
+    type: STRICT_DNS
+    upstreamConnectionOptions:
+      tcpKeepalive: {}
 statsConfig:
   statsTags:
   - regex: ^grpc\.((.+)\.)
diff --git a/pkg/xds/bootstrap/testdata/generator.custom-config.golden.yaml b/pkg/xds/bootstrap/testdata/generator.custom-config.golden.yaml
index a00bf6e79..769dc84ee 100644
--- a/pkg/xds/bootstrap/testdata/generator.custom-config.golden.yaml
+++ b/pkg/xds/bootstrap/testdata/generator.custom-config.golden.yaml
@@ -86,6 +86,34 @@ staticResources:
     type: STATIC
     upstreamConnectionOptions:
       tcpKeepalive: {}
+  - connectTimeout: 2s
+    http2ProtocolOptions: {}
+    loadAssignment:
+      clusterName: ads_cluster
+      endpoints:
+      - lbEndpoints:
+        - endpoint:
+            address:
+              socketAddress:
+                address: localhost
+                portValue: 15678
+    name: ads_cluster
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext
+        commonTlsContext:
+          tlsParams:
+            tlsMinimumProtocolVersion: TLSv1_2
+          validationContext:
+            matchSubjectAltNames:
+            - exact: localhost
+            trustedCa:
+              inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMRENDQWhTZ0F3SUJBZ0lRSGRQaHhPZlhnV3VOeG9GbFYvRXdxVEFOQmdrcWhraUc5dzBCQVFzRkFEQVAKTVEwd0N3WURWUVFERXdScmRXMWhNQjRYRFRJd01Ea3hOakV5TWpnME5Gb1hEVE13TURreE5ERXlNamcwTkZvdwpEekVOTUFzR0ExVUVBeE1FYTNWdFlUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCCkFPWkdiV2hTbFFTUnhGTnQ1cC8yV0NLRnlIWjNDdXdOZ3lMRVA3blM0Wlh5a3hzRmJZU3VWM2JJZ0Y3YlQvdXEKYTVRaXJlK0M2MGd1aEZicExjUGgyWjZVZmdJZDY5R2xRekhNVlljbUxHalZRdXlBdDRGTU1rVGZWRWw1STRPYQorMml0M0J2aWhWa0toVXo4eTVSUjVLYnFKZkdwNFoyMEZoNmZ0dG9DRmJlT0RtdkJzWUpGbVVRUytpZm95TVkvClAzUjAzU3U3ZzVpSXZuejd0bWt5ZG9OQzhuR1JEemRENUM4Zkp2clZJMVVYNkpSR3lMS3Q0NW9RWHQxbXhLMTAKNUthTjJ6TlYyV3RIc2FKcDlid3JQSCtKaVpHZVp5dnVoNVV3ckxkSENtcUs3c205VG9kR3p0VVpZMFZ6QWM0cQprWVZpWFk4Z1VqZk5tK2NRclBPMWtOOENBd0VBQWFPQmd6Q0JnREFPQmdOVkhROEJBZjhFQkFNQ0FxUXdIUVlEClZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQk1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWUQKVlIwT0JCWUVGR01EQlBQaUJGSjNtdjJvQTlDVHFqZW1GVFYyTUI4R0ExVWRFUVFZTUJhQ0NXeHZZMkZzYUc5egpkSUlKYkc5allXeG9iM04wTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDLzE3UXdlT3BHZGIxTUVCSjhYUEc3CjNzSy91dG9XTFgxdGpmOFN1MURnYTZDRFQvZVRXSFpyV1JmODFLT1ZZMDdkbGU1U1JJREsxUWhmYkdHdEZQK1QKdlprcm9vdXNJOVVTMmFDV2xrZUNaV0dUbnF2TG1Eb091anFhZ0RvS1JSdWs0bVFkdE5Ob254aUwvd1p0VEZLaQorMWlOalVWYkxXaURYZEJMeG9SSVZkTE96cWIvTU54d0VsVXlhVERBa29wUXlPV2FURGtZUHJHbWFXamNzZlBHCmFPS293MHplK3pIVkZxVEhiam5DcUVWM2huc1V5UlV3c0JsbjkrakRKWGd3Wk0vdE1sVkpyWkNoMFNsZTlZNVoKTU9CMGZDZjZzVE1OUlRHZzVMcGw2dUlZTS81SU5wbUhWTW8zbjdNQlNucEVEQVVTMmJmL3VvNWdJaXE2WENkcAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        sni: localhost
+    type: STRICT_DNS
+    upstreamConnectionOptions:
+      tcpKeepalive: {}
 statsConfig:
   statsTags:
   - regex: ^grpc\.((.+)\.)
diff --git a/pkg/xds/bootstrap/testdata/generator.default-config-minimal-request.golden.yaml b/pkg/xds/bootstrap/testdata/generator.default-config-minimal-request.golden.yaml
index aff454f5c..5cf9af1c0 100644
--- a/pkg/xds/bootstrap/testdata/generator.default-config-minimal-request.golden.yaml
+++ b/pkg/xds/bootstrap/testdata/generator.default-config-minimal-request.golden.yaml
@@ -2,13 +2,8 @@ dynamicResources:
   adsConfig:
     apiType: GRPC
     grpcServices:
-    - googleGrpc:
-        channelCredentials:
-          sslCredentials:
-            rootCerts:
-              inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMRENDQWhTZ0F3SUJBZ0lRSGRQaHhPZlhnV3VOeG9GbFYvRXdxVEFOQmdrcWhraUc5dzBCQVFzRkFEQVAKTVEwd0N3WURWUVFERXdScmRXMWhNQjRYRFRJd01Ea3hOakV5TWpnME5Gb1hEVE13TURreE5ERXlNamcwTkZvdwpEekVOTUFzR0ExVUVBeE1FYTNWdFlUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCCkFPWkdiV2hTbFFTUnhGTnQ1cC8yV0NLRnlIWjNDdXdOZ3lMRVA3blM0Wlh5a3hzRmJZU3VWM2JJZ0Y3YlQvdXEKYTVRaXJlK0M2MGd1aEZicExjUGgyWjZVZmdJZDY5R2xRekhNVlljbUxHalZRdXlBdDRGTU1rVGZWRWw1STRPYQorMml0M0J2aWhWa0toVXo4eTVSUjVLYnFKZkdwNFoyMEZoNmZ0dG9DRmJlT0RtdkJzWUpGbVVRUytpZm95TVkvClAzUjAzU3U3ZzVpSXZuejd0bWt5ZG9OQzhuR1JEemRENUM4Zkp2clZJMVVYNkpSR3lMS3Q0NW9RWHQxbXhLMTAKNUthTjJ6TlYyV3RIc2FKcDlid3JQSCtKaVpHZVp5dnVoNVV3ckxkSENtcUs3c205VG9kR3p0VVpZMFZ6QWM0cQprWVZpWFk4Z1VqZk5tK2NRclBPMWtOOENBd0VBQWFPQmd6Q0JnREFPQmdOVkhROEJBZjhFQkFNQ0FxUXdIUVlEClZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQk1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWUQKVlIwT0JCWUVGR01EQlBQaUJGSjNtdjJvQTlDVHFqZW1GVFYyTUI4R0ExVWRFUVFZTUJhQ0NXeHZZMkZzYUc5egpkSUlKYkc5allXeG9iM04wTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDLzE3UXdlT3BHZGIxTUVCSjhYUEc3CjNzSy91dG9XTFgxdGpmOFN1MURnYTZDRFQvZVRXSFpyV1JmODFLT1ZZMDdkbGU1U1JJREsxUWhmYkdHdEZQK1QKdlprcm9vdXNJOVVTMmFDV2xrZUNaV0dUbnF2TG1Eb091anFhZ0RvS1JSdWs0bVFkdE5Ob254aUwvd1p0VEZLaQorMWlOalVWYkxXaURYZEJMeG9SSVZkTE96cWIvTU54d0VsVXlhVERBa29wUXlPV2FURGtZUHJHbWFXamNzZlBHCmFPS293MHplK3pIVkZxVEhiam5DcUVWM2huc1V5UlV3c0JsbjkrakRKWGd3Wk0vdE1sVkpyWkNoMFNsZTlZNVoKTU9CMGZDZjZzVE1OUlRHZzVMcGw2dUlZTS81SU5wbUhWTW8zbjdNQlNucEVEQVVTMmJmL3VvNWdJaXE2WENkcAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-        statPrefix: ads
-        targetUri: localhost:5678
+    - envoyGrpc:
+        clusterName: ads_cluster
     transportApiVersion: V2
   cdsConfig:
     ads: {}
@@ -17,13 +12,8 @@ dynamicResources:
 hdsConfig:
   apiType: GRPC
   grpcServices:
-  - googleGrpc:
-      channelCredentials:
-        sslCredentials:
-          rootCerts:
-            inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMRENDQWhTZ0F3SUJBZ0lRSGRQaHhPZlhnV3VOeG9GbFYvRXdxVEFOQmdrcWhraUc5dzBCQVFzRkFEQVAKTVEwd0N3WURWUVFERXdScmRXMWhNQjRYRFRJd01Ea3hOakV5TWpnME5Gb1hEVE13TURreE5ERXlNamcwTkZvdwpEekVOTUFzR0ExVUVBeE1FYTNWdFlUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCCkFPWkdiV2hTbFFTUnhGTnQ1cC8yV0NLRnlIWjNDdXdOZ3lMRVA3blM0Wlh5a3hzRmJZU3VWM2JJZ0Y3YlQvdXEKYTVRaXJlK0M2MGd1aEZicExjUGgyWjZVZmdJZDY5R2xRekhNVlljbUxHalZRdXlBdDRGTU1rVGZWRWw1STRPYQorMml0M0J2aWhWa0toVXo4eTVSUjVLYnFKZkdwNFoyMEZoNmZ0dG9DRmJlT0RtdkJzWUpGbVVRUytpZm95TVkvClAzUjAzU3U3ZzVpSXZuejd0bWt5ZG9OQzhuR1JEemRENUM4Zkp2clZJMVVYNkpSR3lMS3Q0NW9RWHQxbXhLMTAKNUthTjJ6TlYyV3RIc2FKcDlid3JQSCtKaVpHZVp5dnVoNVV3ckxkSENtcUs3c205VG9kR3p0VVpZMFZ6QWM0cQprWVZpWFk4Z1VqZk5tK2NRclBPMWtOOENBd0VBQWFPQmd6Q0JnREFPQmdOVkhROEJBZjhFQkFNQ0FxUXdIUVlEClZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQk1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWUQKVlIwT0JCWUVGR01EQlBQaUJGSjNtdjJvQTlDVHFqZW1GVFYyTUI4R0ExVWRFUVFZTUJhQ0NXeHZZMkZzYUc5egpkSUlKYkc5allXeG9iM04wTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDLzE3UXdlT3BHZGIxTUVCSjhYUEc3CjNzSy91dG9XTFgxdGpmOFN1MURnYTZDRFQvZVRXSFpyV1JmODFLT1ZZMDdkbGU1U1JJREsxUWhmYkdHdEZQK1QKdlprcm9vdXNJOVVTMmFDV2xrZUNaV0dUbnF2TG1Eb091anFhZ0RvS1JSdWs0bVFkdE5Ob254aUwvd1p0VEZLaQorMWlOalVWYkxXaURYZEJMeG9SSVZkTE96cWIvTU54d0VsVXlhVERBa29wUXlPV2FURGtZUHJHbWFXamNzZlBHCmFPS293MHplK3pIVkZxVEhiam5DcUVWM2huc1V5UlV3c0JsbjkrakRKWGd3Wk0vdE1sVkpyWkNoMFNsZTlZNVoKTU9CMGZDZjZzVE1OUlRHZzVMcGw2dUlZTS81SU5wbUhWTW8zbjdNQlNucEVEQVVTMmJmL3VvNWdJaXE2WENkcAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-      statPrefix: hds
-      targetUri: localhost:5678
+  - envoyGrpc:
+      clusterName: ads_cluster
   setNodeOnFirstMessageOnly: true
   transportApiVersion: V3
 node:
@@ -55,6 +45,34 @@ staticResources:
     type: STATIC
     upstreamConnectionOptions:
       tcpKeepalive: {}
+  - connectTimeout: 1s
+    http2ProtocolOptions: {}
+    loadAssignment:
+      clusterName: ads_cluster
+      endpoints:
+      - lbEndpoints:
+        - endpoint:
+            address:
+              socketAddress:
+                address: localhost
+                portValue: 5678
+    name: ads_cluster
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext
+        commonTlsContext:
+          tlsParams:
+            tlsMinimumProtocolVersion: TLSv1_2
+          validationContext:
+            matchSubjectAltNames:
+            - exact: localhost
+            trustedCa:
+              inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMRENDQWhTZ0F3SUJBZ0lRSGRQaHhPZlhnV3VOeG9GbFYvRXdxVEFOQmdrcWhraUc5dzBCQVFzRkFEQVAKTVEwd0N3WURWUVFERXdScmRXMWhNQjRYRFRJd01Ea3hOakV5TWpnME5Gb1hEVE13TURreE5ERXlNamcwTkZvdwpEekVOTUFzR0ExVUVBeE1FYTNWdFlUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCCkFPWkdiV2hTbFFTUnhGTnQ1cC8yV0NLRnlIWjNDdXdOZ3lMRVA3blM0Wlh5a3hzRmJZU3VWM2JJZ0Y3YlQvdXEKYTVRaXJlK0M2MGd1aEZicExjUGgyWjZVZmdJZDY5R2xRekhNVlljbUxHalZRdXlBdDRGTU1rVGZWRWw1STRPYQorMml0M0J2aWhWa0toVXo4eTVSUjVLYnFKZkdwNFoyMEZoNmZ0dG9DRmJlT0RtdkJzWUpGbVVRUytpZm95TVkvClAzUjAzU3U3ZzVpSXZuejd0bWt5ZG9OQzhuR1JEemRENUM4Zkp2clZJMVVYNkpSR3lMS3Q0NW9RWHQxbXhLMTAKNUthTjJ6TlYyV3RIc2FKcDlid3JQSCtKaVpHZVp5dnVoNVV3ckxkSENtcUs3c205VG9kR3p0VVpZMFZ6QWM0cQprWVZpWFk4Z1VqZk5tK2NRclBPMWtOOENBd0VBQWFPQmd6Q0JnREFPQmdOVkhROEJBZjhFQkFNQ0FxUXdIUVlEClZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQk1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWUQKVlIwT0JCWUVGR01EQlBQaUJGSjNtdjJvQTlDVHFqZW1GVFYyTUI4R0ExVWRFUVFZTUJhQ0NXeHZZMkZzYUc5egpkSUlKYkc5allXeG9iM04wTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDLzE3UXdlT3BHZGIxTUVCSjhYUEc3CjNzSy91dG9XTFgxdGpmOFN1MURnYTZDRFQvZVRXSFpyV1JmODFLT1ZZMDdkbGU1U1JJREsxUWhmYkdHdEZQK1QKdlprcm9vdXNJOVVTMmFDV2xrZUNaV0dUbnF2TG1Eb091anFhZ0RvS1JSdWs0bVFkdE5Ob254aUwvd1p0VEZLaQorMWlOalVWYkxXaURYZEJMeG9SSVZkTE96cWIvTU54d0VsVXlhVERBa29wUXlPV2FURGtZUHJHbWFXamNzZlBHCmFPS293MHplK3pIVkZxVEhiam5DcUVWM2huc1V5UlV3c0JsbjkrakRKWGd3Wk0vdE1sVkpyWkNoMFNsZTlZNVoKTU9CMGZDZjZzVE1OUlRHZzVMcGw2dUlZTS81SU5wbUhWTW8zbjdNQlNucEVEQVVTMmJmL3VvNWdJaXE2WENkcAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        sni: localhost
+    type: STRICT_DNS
+    upstreamConnectionOptions:
+      tcpKeepalive: {}
 statsConfig:
   statsTags:
   - regex: ^grpc\.((.+)\.)
diff --git a/pkg/xds/bootstrap/testdata/generator.default-config.golden.yaml b/pkg/xds/bootstrap/testdata/generator.default-config.golden.yaml
index 74e867e80..9f8e50e45 100644
--- a/pkg/xds/bootstrap/testdata/generator.default-config.golden.yaml
+++ b/pkg/xds/bootstrap/testdata/generator.default-config.golden.yaml
@@ -8,21 +8,11 @@ dynamicResources:
   adsConfig:
     apiType: GRPC
     grpcServices:
-    - googleGrpc:
-        callCredentials:
-        - fromPlugin:
-            name: envoy.grpc_credentials.file_based_metadata
-            typedConfig:
-              '@type': type.googleapis.com/envoy.config.grpc_credential.v3.FileBasedMetadataConfig
-              secretData:
-                filename: /tmp/token
-        channelCredentials:
-          sslCredentials:
-            rootCerts:
-              inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMRENDQWhTZ0F3SUJBZ0lRSGRQaHhPZlhnV3VOeG9GbFYvRXdxVEFOQmdrcWhraUc5dzBCQVFzRkFEQVAKTVEwd0N3WURWUVFERXdScmRXMWhNQjRYRFRJd01Ea3hOakV5TWpnME5Gb1hEVE13TURreE5ERXlNamcwTkZvdwpEekVOTUFzR0ExVUVBeE1FYTNWdFlUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCCkFPWkdiV2hTbFFTUnhGTnQ1cC8yV0NLRnlIWjNDdXdOZ3lMRVA3blM0Wlh5a3hzRmJZU3VWM2JJZ0Y3YlQvdXEKYTVRaXJlK0M2MGd1aEZicExjUGgyWjZVZmdJZDY5R2xRekhNVlljbUxHalZRdXlBdDRGTU1rVGZWRWw1STRPYQorMml0M0J2aWhWa0toVXo4eTVSUjVLYnFKZkdwNFoyMEZoNmZ0dG9DRmJlT0RtdkJzWUpGbVVRUytpZm95TVkvClAzUjAzU3U3ZzVpSXZuejd0bWt5ZG9OQzhuR1JEemRENUM4Zkp2clZJMVVYNkpSR3lMS3Q0NW9RWHQxbXhLMTAKNUthTjJ6TlYyV3RIc2FKcDlid3JQSCtKaVpHZVp5dnVoNVV3ckxkSENtcUs3c205VG9kR3p0VVpZMFZ6QWM0cQprWVZpWFk4Z1VqZk5tK2NRclBPMWtOOENBd0VBQWFPQmd6Q0JnREFPQmdOVkhROEJBZjhFQkFNQ0FxUXdIUVlEClZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQk1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWUQKVlIwT0JCWUVGR01EQlBQaUJGSjNtdjJvQTlDVHFqZW1GVFYyTUI4R0ExVWRFUVFZTUJhQ0NXeHZZMkZzYUc5egpkSUlKYkc5allXeG9iM04wTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDLzE3UXdlT3BHZGIxTUVCSjhYUEc3CjNzSy91dG9XTFgxdGpmOFN1MURnYTZDRFQvZVRXSFpyV1JmODFLT1ZZMDdkbGU1U1JJREsxUWhmYkdHdEZQK1QKdlprcm9vdXNJOVVTMmFDV2xrZUNaV0dUbnF2TG1Eb091anFhZ0RvS1JSdWs0bVFkdE5Ob254aUwvd1p0VEZLaQorMWlOalVWYkxXaURYZEJMeG9SSVZkTE96cWIvTU54d0VsVXlhVERBa29wUXlPV2FURGtZUHJHbWFXamNzZlBHCmFPS293MHplK3pIVkZxVEhiam5DcUVWM2huc1V5UlV3c0JsbjkrakRKWGd3Wk0vdE1sVkpyWkNoMFNsZTlZNVoKTU9CMGZDZjZzVE1OUlRHZzVMcGw2dUlZTS81SU5wbUhWTW8zbjdNQlNucEVEQVVTMmJmL3VvNWdJaXE2WENkcAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-        credentialsFactoryName: envoy.grpc_credentials.file_based_metadata
-        statPrefix: ads
-        targetUri: localhost:5678
+    - envoyGrpc:
+        clusterName: ads_cluster
+      initialMetadata:
+      - key: authorization
+        value: token
     transportApiVersion: V3
   cdsConfig:
     ads: {}
@@ -33,21 +23,11 @@ dynamicResources:
 hdsConfig:
   apiType: GRPC
   grpcServices:
-  - googleGrpc:
-      callCredentials:
-      - fromPlugin:
-          name: envoy.grpc_credentials.file_based_metadata
-          typedConfig:
-            '@type': type.googleapis.com/envoy.config.grpc_credential.v3.FileBasedMetadataConfig
-            secretData:
-              filename: /tmp/token
-      channelCredentials:
-        sslCredentials:
-          rootCerts:
-            inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMRENDQWhTZ0F3SUJBZ0lRSGRQaHhPZlhnV3VOeG9GbFYvRXdxVEFOQmdrcWhraUc5dzBCQVFzRkFEQVAKTVEwd0N3WURWUVFERXdScmRXMWhNQjRYRFRJd01Ea3hOakV5TWpnME5Gb1hEVE13TURreE5ERXlNamcwTkZvdwpEekVOTUFzR0ExVUVBeE1FYTNWdFlUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCCkFPWkdiV2hTbFFTUnhGTnQ1cC8yV0NLRnlIWjNDdXdOZ3lMRVA3blM0Wlh5a3hzRmJZU3VWM2JJZ0Y3YlQvdXEKYTVRaXJlK0M2MGd1aEZicExjUGgyWjZVZmdJZDY5R2xRekhNVlljbUxHalZRdXlBdDRGTU1rVGZWRWw1STRPYQorMml0M0J2aWhWa0toVXo4eTVSUjVLYnFKZkdwNFoyMEZoNmZ0dG9DRmJlT0RtdkJzWUpGbVVRUytpZm95TVkvClAzUjAzU3U3ZzVpSXZuejd0bWt5ZG9OQzhuR1JEemRENUM4Zkp2clZJMVVYNkpSR3lMS3Q0NW9RWHQxbXhLMTAKNUthTjJ6TlYyV3RIc2FKcDlid3JQSCtKaVpHZVp5dnVoNVV3ckxkSENtcUs3c205VG9kR3p0VVpZMFZ6QWM0cQprWVZpWFk4Z1VqZk5tK2NRclBPMWtOOENBd0VBQWFPQmd6Q0JnREFPQmdOVkhROEJBZjhFQkFNQ0FxUXdIUVlEClZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQk1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWUQKVlIwT0JCWUVGR01EQlBQaUJGSjNtdjJvQTlDVHFqZW1GVFYyTUI4R0ExVWRFUVFZTUJhQ0NXeHZZMkZzYUc5egpkSUlKYkc5allXeG9iM04wTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDLzE3UXdlT3BHZGIxTUVCSjhYUEc3CjNzSy91dG9XTFgxdGpmOFN1MURnYTZDRFQvZVRXSFpyV1JmODFLT1ZZMDdkbGU1U1JJREsxUWhmYkdHdEZQK1QKdlprcm9vdXNJOVVTMmFDV2xrZUNaV0dUbnF2TG1Eb091anFhZ0RvS1JSdWs0bVFkdE5Ob254aUwvd1p0VEZLaQorMWlOalVWYkxXaURYZEJMeG9SSVZkTE96cWIvTU54d0VsVXlhVERBa29wUXlPV2FURGtZUHJHbWFXamNzZlBHCmFPS293MHplK3pIVkZxVEhiam5DcUVWM2huc1V5UlV3c0JsbjkrakRKWGd3Wk0vdE1sVkpyWkNoMFNsZTlZNVoKTU9CMGZDZjZzVE1OUlRHZzVMcGw2dUlZTS81SU5wbUhWTW8zbjdNQlNucEVEQVVTMmJmL3VvNWdJaXE2WENkcAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-      credentialsFactoryName: envoy.grpc_credentials.file_based_metadata
-      statPrefix: hds
-      targetUri: localhost:5678
+  - envoyGrpc:
+      clusterName: ads_cluster
+    initialMetadata:
+    - key: authorization
+      value: token
   setNodeOnFirstMessageOnly: true
   transportApiVersion: V3
 node:
@@ -55,7 +35,7 @@ node:
   id: mesh.name.namespace
   metadata:
     dataplane.admin.port: "1234"
-    dataplaneTokenPath: /tmp/token
+    dataplane.token: token
     version:
       envoy:
         build: hash/1.15.0/RELEASE
@@ -81,6 +61,34 @@ staticResources:
     type: STATIC
     upstreamConnectionOptions:
       tcpKeepalive: {}
+  - connectTimeout: 1s
+    http2ProtocolOptions: {}
+    loadAssignment:
+      clusterName: ads_cluster
+      endpoints:
+      - lbEndpoints:
+        - endpoint:
+            address:
+              socketAddress:
+                address: localhost
+                portValue: 5678
+    name: ads_cluster
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        commonTlsContext:
+          tlsParams:
+            tlsMinimumProtocolVersion: TLSv1_2
+          validationContext:
+            matchSubjectAltNames:
+            - exact: localhost
+            trustedCa:
+              inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMRENDQWhTZ0F3SUJBZ0lRSGRQaHhPZlhnV3VOeG9GbFYvRXdxVEFOQmdrcWhraUc5dzBCQVFzRkFEQVAKTVEwd0N3WURWUVFERXdScmRXMWhNQjRYRFRJd01Ea3hOakV5TWpnME5Gb1hEVE13TURreE5ERXlNamcwTkZvdwpEekVOTUFzR0ExVUVBeE1FYTNWdFlUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCCkFPWkdiV2hTbFFTUnhGTnQ1cC8yV0NLRnlIWjNDdXdOZ3lMRVA3blM0Wlh5a3hzRmJZU3VWM2JJZ0Y3YlQvdXEKYTVRaXJlK0M2MGd1aEZicExjUGgyWjZVZmdJZDY5R2xRekhNVlljbUxHalZRdXlBdDRGTU1rVGZWRWw1STRPYQorMml0M0J2aWhWa0toVXo4eTVSUjVLYnFKZkdwNFoyMEZoNmZ0dG9DRmJlT0RtdkJzWUpGbVVRUytpZm95TVkvClAzUjAzU3U3ZzVpSXZuejd0bWt5ZG9OQzhuR1JEemRENUM4Zkp2clZJMVVYNkpSR3lMS3Q0NW9RWHQxbXhLMTAKNUthTjJ6TlYyV3RIc2FKcDlid3JQSCtKaVpHZVp5dnVoNVV3ckxkSENtcUs3c205VG9kR3p0VVpZMFZ6QWM0cQprWVZpWFk4Z1VqZk5tK2NRclBPMWtOOENBd0VBQWFPQmd6Q0JnREFPQmdOVkhROEJBZjhFQkFNQ0FxUXdIUVlEClZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQk1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWUQKVlIwT0JCWUVGR01EQlBQaUJGSjNtdjJvQTlDVHFqZW1GVFYyTUI4R0ExVWRFUVFZTUJhQ0NXeHZZMkZzYUc5egpkSUlKYkc5allXeG9iM04wTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDLzE3UXdlT3BHZGIxTUVCSjhYUEc3CjNzSy91dG9XTFgxdGpmOFN1MURnYTZDRFQvZVRXSFpyV1JmODFLT1ZZMDdkbGU1U1JJREsxUWhmYkdHdEZQK1QKdlprcm9vdXNJOVVTMmFDV2xrZUNaV0dUbnF2TG1Eb091anFhZ0RvS1JSdWs0bVFkdE5Ob254aUwvd1p0VEZLaQorMWlOalVWYkxXaURYZEJMeG9SSVZkTE96cWIvTU54d0VsVXlhVERBa29wUXlPV2FURGtZUHJHbWFXamNzZlBHCmFPS293MHplK3pIVkZxVEhiam5DcUVWM2huc1V5UlV3c0JsbjkrakRKWGd3Wk0vdE1sVkpyWkNoMFNsZTlZNVoKTU9CMGZDZjZzVE1OUlRHZzVMcGw2dUlZTS81SU5wbUhWTW8zbjdNQlNucEVEQVVTMmJmL3VvNWdJaXE2WENkcAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        sni: localhost
+    type: STRICT_DNS
+    upstreamConnectionOptions:
+      tcpKeepalive: {}
 statsConfig:
   statsTags:
   - regex: ^grpc\.((.+)\.)
diff --git a/pkg/xds/bootstrap/testdata/generator.default-config.kubernetes.golden.yaml b/pkg/xds/bootstrap/testdata/generator.default-config.kubernetes.golden.yaml
index 8e89f6c05..04da94921 100644
--- a/pkg/xds/bootstrap/testdata/generator.default-config.kubernetes.golden.yaml
+++ b/pkg/xds/bootstrap/testdata/generator.default-config.kubernetes.golden.yaml
@@ -61,6 +61,34 @@ staticResources:
     type: STATIC
     upstreamConnectionOptions:
       tcpKeepalive: {}
+  - connectTimeout: 1s
+    http2ProtocolOptions: {}
+    loadAssignment:
+      clusterName: ads_cluster
+      endpoints:
+      - lbEndpoints:
+        - endpoint:
+            address:
+              socketAddress:
+                address: localhost
+                portValue: 5678
+    name: ads_cluster
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        commonTlsContext:
+          tlsParams:
+            tlsMinimumProtocolVersion: TLSv1_2
+          validationContext:
+            matchSubjectAltNames:
+            - exact: localhost
+            trustedCa:
+              inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMRENDQWhTZ0F3SUJBZ0lRSGRQaHhPZlhnV3VOeG9GbFYvRXdxVEFOQmdrcWhraUc5dzBCQVFzRkFEQVAKTVEwd0N3WURWUVFERXdScmRXMWhNQjRYRFRJd01Ea3hOakV5TWpnME5Gb1hEVE13TURreE5ERXlNamcwTkZvdwpEekVOTUFzR0ExVUVBeE1FYTNWdFlUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCCkFPWkdiV2hTbFFTUnhGTnQ1cC8yV0NLRnlIWjNDdXdOZ3lMRVA3blM0Wlh5a3hzRmJZU3VWM2JJZ0Y3YlQvdXEKYTVRaXJlK0M2MGd1aEZicExjUGgyWjZVZmdJZDY5R2xRekhNVlljbUxHalZRdXlBdDRGTU1rVGZWRWw1STRPYQorMml0M0J2aWhWa0toVXo4eTVSUjVLYnFKZkdwNFoyMEZoNmZ0dG9DRmJlT0RtdkJzWUpGbVVRUytpZm95TVkvClAzUjAzU3U3ZzVpSXZuejd0bWt5ZG9OQzhuR1JEemRENUM4Zkp2clZJMVVYNkpSR3lMS3Q0NW9RWHQxbXhLMTAKNUthTjJ6TlYyV3RIc2FKcDlid3JQSCtKaVpHZVp5dnVoNVV3ckxkSENtcUs3c205VG9kR3p0VVpZMFZ6QWM0cQprWVZpWFk4Z1VqZk5tK2NRclBPMWtOOENBd0VBQWFPQmd6Q0JnREFPQmdOVkhROEJBZjhFQkFNQ0FxUXdIUVlEClZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQk1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWUQKVlIwT0JCWUVGR01EQlBQaUJGSjNtdjJvQTlDVHFqZW1GVFYyTUI4R0ExVWRFUVFZTUJhQ0NXeHZZMkZzYUc5egpkSUlKYkc5allXeG9iM04wTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDLzE3UXdlT3BHZGIxTUVCSjhYUEc3CjNzSy91dG9XTFgxdGpmOFN1MURnYTZDRFQvZVRXSFpyV1JmODFLT1ZZMDdkbGU1U1JJREsxUWhmYkdHdEZQK1QKdlprcm9vdXNJOVVTMmFDV2xrZUNaV0dUbnF2TG1Eb091anFhZ0RvS1JSdWs0bVFkdE5Ob254aUwvd1p0VEZLaQorMWlOalVWYkxXaURYZEJMeG9SSVZkTE96cWIvTU54d0VsVXlhVERBa29wUXlPV2FURGtZUHJHbWFXamNzZlBHCmFPS293MHplK3pIVkZxVEhiam5DcUVWM2huc1V5UlV3c0JsbjkrakRKWGd3Wk0vdE1sVkpyWkNoMFNsZTlZNVoKTU9CMGZDZjZzVE1OUlRHZzVMcGw2dUlZTS81SU5wbUhWTW8zbjdNQlNucEVEQVVTMmJmL3VvNWdJaXE2WENkcAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        sni: localhost
+    type: STRICT_DNS
+    upstreamConnectionOptions:
+      tcpKeepalive: {}
 statsConfig:
   statsTags:
   - regex: ^grpc\.((.+)\.)
diff --git a/pkg/xds/envoy/clusters/v2/client_side_mtls_configurer_test.go b/pkg/xds/envoy/clusters/v2/client_side_mtls_configurer_test.go
index 42cab04ba..3ca64f26e 100644
--- a/pkg/xds/envoy/clusters/v2/client_side_mtls_configurer_test.go
+++ b/pkg/xds/envoy/clusters/v2/client_side_mtls_configurer_test.go
@@ -96,26 +96,20 @@ var _ = Describe("EdsClusterConfigurer", func() {
                         apiConfigSource:
                           apiType: GRPC
                           grpcServices:
-                          - googleGrpc:
-                              channelCredentials:
-                                sslCredentials:
-                                  rootCerts:
-                                    inlineBytes: Q0VSVElGSUNBVEU=
-                              statPrefix: sds_mesh_ca
-                              targetUri: kuma-control-plane:5677
+                          - envoyGrpc:
+                              clusterName: ads_cluster
+                          transportApiVersion: V2
+                        resourceApiVersion: V2
                   tlsCertificateSdsSecretConfigs:
                   - name: identity_cert
                     sdsConfig:
                       apiConfigSource:
                         apiType: GRPC
                         grpcServices:
-                        - googleGrpc:
-                            channelCredentials:
-                              sslCredentials:
-                                rootCerts:
-                                  inlineBytes: Q0VSVElGSUNBVEU=
-                            statPrefix: sds_identity_cert
-                            targetUri: kuma-control-plane:5677
+                        - envoyGrpc:
+                            clusterName: ads_cluster
+                        transportApiVersion: V2
+                      resourceApiVersion: V2
             type: EDS`,
 		}),
 		Entry("cluster with many different tag sets", testCase{
@@ -182,26 +176,20 @@ var _ = Describe("EdsClusterConfigurer", func() {
                           apiConfigSource:
                             apiType: GRPC
                             grpcServices:
-                            - googleGrpc:
-                                channelCredentials:
-                                  sslCredentials:
-                                    rootCerts:
-                                      inlineBytes: Q0VSVElGSUNBVEU=
-                                statPrefix: sds_mesh_ca
-                                targetUri: kuma-control-plane:5677
+                            - envoyGrpc:
+                                clusterName: ads_cluster
+                            transportApiVersion: V2
+                          resourceApiVersion: V2
                     tlsCertificateSdsSecretConfigs:
                     - name: identity_cert
                       sdsConfig:
                         apiConfigSource:
                           apiType: GRPC
                           grpcServices:
-                          - googleGrpc:
-                              channelCredentials:
-                                sslCredentials:
-                                  rootCerts:
-                                    inlineBytes: Q0VSVElGSUNBVEU=
-                              statPrefix: sds_identity_cert
-                              targetUri: kuma-control-plane:5677
+                          - envoyGrpc:
+                              clusterName: ads_cluster
+                          transportApiVersion: V2
+                        resourceApiVersion: V2
                   sni: backend{cluster=1,mesh=default}
             - match:
                 cluster: "2"
@@ -221,26 +209,20 @@ var _ = Describe("EdsClusterConfigurer", func() {
                           apiConfigSource:
                             apiType: GRPC
                             grpcServices:
-                            - googleGrpc:
-                                channelCredentials:
-                                  sslCredentials:
-                                    rootCerts:
-                                      inlineBytes: Q0VSVElGSUNBVEU=
-                                statPrefix: sds_mesh_ca
-                                targetUri: kuma-control-plane:5677
+                            - envoyGrpc:
+                                clusterName: ads_cluster
+                            transportApiVersion: V2
+                          resourceApiVersion: V2
                     tlsCertificateSdsSecretConfigs:
                     - name: identity_cert
                       sdsConfig:
                         apiConfigSource:
                           apiType: GRPC
                           grpcServices:
-                          - googleGrpc:
-                              channelCredentials:
-                                sslCredentials:
-                                  rootCerts:
-                                    inlineBytes: Q0VSVElGSUNBVEU=
-                              statPrefix: sds_identity_cert
-                              targetUri: kuma-control-plane:5677
+                          - envoyGrpc:
+                              clusterName: ads_cluster
+                          transportApiVersion: V2
+                        resourceApiVersion: V2
                   sni: backend{cluster=2,mesh=default}
             type: EDS`,
 		}),
@@ -318,6 +300,8 @@ var _ = Describe("EdsClusterConfigurer", func() {
                               credentialsFactoryName: envoy.grpc_credentials.file_based_metadata
                               statPrefix: sds_mesh_ca
                               targetUri: kuma-control-plane:5677
+                          transportApiVersion: V2
+                        resourceApiVersion: V2
                   tlsCertificateSdsSecretConfigs:
                   - name: identity_cert
                     sdsConfig:
@@ -339,6 +323,8 @@ var _ = Describe("EdsClusterConfigurer", func() {
                             credentialsFactoryName: envoy.grpc_credentials.file_based_metadata
                             statPrefix: sds_identity_cert
                             targetUri: kuma-control-plane:5677
+                        transportApiVersion: V2
+                      resourceApiVersion: V2
                 sni: backend{mesh=default,version=v1}
             type: EDS`,
 		}),
diff --git a/pkg/xds/envoy/clusters/v3/client_side_mtls_configurer_test.go b/pkg/xds/envoy/clusters/v3/client_side_mtls_configurer_test.go
index 3cf803f9d..f148ec8ee 100644
--- a/pkg/xds/envoy/clusters/v3/client_side_mtls_configurer_test.go
+++ b/pkg/xds/envoy/clusters/v3/client_side_mtls_configurer_test.go
@@ -97,13 +97,8 @@ var _ = Describe("EdsClusterConfigurer", func() {
                         apiConfigSource:
                           apiType: GRPC
                           grpcServices:
-                          - googleGrpc:
-                              channelCredentials:
-                                sslCredentials:
-                                  rootCerts:
-                                    inlineBytes: Q0VSVElGSUNBVEU=
-                              statPrefix: sds_mesh_ca
-                              targetUri: kuma-control-plane:5677
+                          - envoyGrpc:
+                              clusterName: ads_cluster
                           transportApiVersion: V3
                         resourceApiVersion: V3
                   tlsCertificateSdsSecretConfigs:
@@ -112,13 +107,8 @@ var _ = Describe("EdsClusterConfigurer", func() {
                       apiConfigSource:
                         apiType: GRPC
                         grpcServices:
-                        - googleGrpc:
-                            channelCredentials:
-                              sslCredentials:
-                                rootCerts:
-                                  inlineBytes: Q0VSVElGSUNBVEU=
-                            statPrefix: sds_identity_cert
-                            targetUri: kuma-control-plane:5677
+                        - envoyGrpc:
+                            clusterName: ads_cluster
                         transportApiVersion: V3
                       resourceApiVersion: V3
             type: EDS`,
@@ -188,13 +178,8 @@ var _ = Describe("EdsClusterConfigurer", func() {
                           apiConfigSource:
                             apiType: GRPC
                             grpcServices:
-                            - googleGrpc:
-                                channelCredentials:
-                                  sslCredentials:
-                                    rootCerts:
-                                      inlineBytes: Q0VSVElGSUNBVEU=
-                                statPrefix: sds_mesh_ca
-                                targetUri: kuma-control-plane:5677
+                            - envoyGrpc:
+                                clusterName: ads_cluster
                             transportApiVersion: V3
                           resourceApiVersion: V3
                     tlsCertificateSdsSecretConfigs:
@@ -203,13 +188,8 @@ var _ = Describe("EdsClusterConfigurer", func() {
                         apiConfigSource:
                           apiType: GRPC
                           grpcServices:
-                          - googleGrpc:
-                              channelCredentials:
-                                sslCredentials:
-                                  rootCerts:
-                                    inlineBytes: Q0VSVElGSUNBVEU=
-                              statPrefix: sds_identity_cert
-                              targetUri: kuma-control-plane:5677
+                          - envoyGrpc:
+                              clusterName: ads_cluster
                           transportApiVersion: V3
                         resourceApiVersion: V3
                   sni: backend{cluster=1,mesh=default}
@@ -231,13 +211,8 @@ var _ = Describe("EdsClusterConfigurer", func() {
                           apiConfigSource:
                             apiType: GRPC
                             grpcServices:
-                            - googleGrpc:
-                                channelCredentials:
-                                  sslCredentials:
-                                    rootCerts:
-                                      inlineBytes: Q0VSVElGSUNBVEU=
-                                statPrefix: sds_mesh_ca
-                                targetUri: kuma-control-plane:5677
+                            - envoyGrpc:
+                                clusterName: ads_cluster
                             transportApiVersion: V3
                           resourceApiVersion: V3
                     tlsCertificateSdsSecretConfigs:
@@ -246,13 +221,8 @@ var _ = Describe("EdsClusterConfigurer", func() {
                         apiConfigSource:
                           apiType: GRPC
                           grpcServices:
-                          - googleGrpc:
-                              channelCredentials:
-                                sslCredentials:
-                                  rootCerts:
-                                    inlineBytes: Q0VSVElGSUNBVEU=
-                              statPrefix: sds_identity_cert
-                              targetUri: kuma-control-plane:5677
+                          - envoyGrpc:
+                              clusterName: ads_cluster
                           transportApiVersion: V3
                         resourceApiVersion: V3
                   sni: backend{cluster=2,mesh=default}
diff --git a/pkg/xds/envoy/listeners/v2/server_mtls_configurer_test.go b/pkg/xds/envoy/listeners/v2/server_mtls_configurer_test.go
index 9c8a4cef9..1067480a7 100644
--- a/pkg/xds/envoy/listeners/v2/server_mtls_configurer_test.go
+++ b/pkg/xds/envoy/listeners/v2/server_mtls_configurer_test.go
@@ -108,26 +108,20 @@ var _ = Describe("ServerMtlsConfigurer", func() {
                           apiConfigSource:
                             apiType: GRPC
                             grpcServices:
-                            - googleGrpc:
-                                channelCredentials:
-                                  sslCredentials:
-                                    rootCerts:
-                                      inlineBytes: Q0VSVElGSUNBVEU=
-                                statPrefix: sds_mesh_ca
-                                targetUri: kuma-control-plane:5677
+                            - envoyGrpc:
+                                clusterName: ads_cluster
+                            transportApiVersion: V2
+                          resourceApiVersion: V2
                     tlsCertificateSdsSecretConfigs:
                     - name: identity_cert
                       sdsConfig:
                         apiConfigSource:
                           apiType: GRPC
                           grpcServices:
-                          - googleGrpc:
-                              channelCredentials:
-                                sslCredentials:
-                                  rootCerts:
-                                    inlineBytes: Q0VSVElGSUNBVEU=
-                              statPrefix: sds_identity_cert
-                              targetUri: kuma-control-plane:5677
+                          - envoyGrpc:
+                              clusterName: ads_cluster
+                          transportApiVersion: V2
+                        resourceApiVersion: V2
                   requireClientCertificate: true
             name: inbound:192.168.0.1:8080
             trafficDirection: INBOUND
@@ -210,6 +204,8 @@ var _ = Describe("ServerMtlsConfigurer", func() {
                                 credentialsFactoryName: envoy.grpc_credentials.file_based_metadata
                                 statPrefix: sds_mesh_ca
                                 targetUri: kuma-control-plane:5677
+                            transportApiVersion: V2
+                          resourceApiVersion: V2
                     tlsCertificateSdsSecretConfigs:
                     - name: identity_cert
                       sdsConfig:
@@ -231,6 +227,8 @@ var _ = Describe("ServerMtlsConfigurer", func() {
                               credentialsFactoryName: envoy.grpc_credentials.file_based_metadata
                               statPrefix: sds_identity_cert
                               targetUri: kuma-control-plane:5677
+                          transportApiVersion: V2
+                        resourceApiVersion: V2
                   requireClientCertificate: true
             name: inbound:192.168.0.1:8080
             trafficDirection: INBOUND
diff --git a/pkg/xds/envoy/listeners/v3/server_mtls_configurer_test.go b/pkg/xds/envoy/listeners/v3/server_mtls_configurer_test.go
index 5eddbefc0..392d4319a 100644
--- a/pkg/xds/envoy/listeners/v3/server_mtls_configurer_test.go
+++ b/pkg/xds/envoy/listeners/v3/server_mtls_configurer_test.go
@@ -108,13 +108,8 @@ var _ = Describe("ServerMtlsConfigurer", func() {
                           apiConfigSource:
                             apiType: GRPC
                             grpcServices:
-                            - googleGrpc:
-                                channelCredentials:
-                                  sslCredentials:
-                                    rootCerts:
-                                      inlineBytes: Q0VSVElGSUNBVEU=
-                                statPrefix: sds_mesh_ca
-                                targetUri: kuma-control-plane:5677
+                            - envoyGrpc:
+                                clusterName: ads_cluster
                             transportApiVersion: V3
                           resourceApiVersion: V3
                     tlsCertificateSdsSecretConfigs:
@@ -123,13 +118,8 @@ var _ = Describe("ServerMtlsConfigurer", func() {
                         apiConfigSource:
                           apiType: GRPC
                           grpcServices:
-                          - googleGrpc:
-                              channelCredentials:
-                                sslCredentials:
-                                  rootCerts:
-                                    inlineBytes: Q0VSVElGSUNBVEU=
-                              statPrefix: sds_identity_cert
-                              targetUri: kuma-control-plane:5677
+                          - envoyGrpc:
+                              clusterName: ads_cluster
                           transportApiVersion: V3
                         resourceApiVersion: V3
                   requireClientCertificate: true
diff --git a/pkg/xds/envoy/tls/v2/tls_test.go b/pkg/xds/envoy/tls/v2/tls_test.go
index 101039144..4a53d0034 100644
--- a/pkg/xds/envoy/tls/v2/tls_test.go
+++ b/pkg/xds/envoy/tls/v2/tls_test.go
@@ -99,26 +99,20 @@ var _ = Describe("CreateDownstreamTlsContext()", func() {
                         apiConfigSource:
                           apiType: GRPC
                           grpcServices:
-                          - googleGrpc:
-                              channelCredentials:
-                                sslCredentials:
-                                  rootCerts:
-                                    inlineBytes: Q0VSVElGSUNBVEU=
-                              statPrefix: sds_mesh_ca
-                              targetUri: kuma-control-plane:5677
+                          - envoyGrpc:
+                              clusterName: ads_cluster
+                          transportApiVersion: V2
+                        resourceApiVersion: V2
                   tlsCertificateSdsSecretConfigs:
                   - name: identity_cert
                     sdsConfig:
                       apiConfigSource:
                         apiType: GRPC
                         grpcServices:
-                        - googleGrpc:
-                            channelCredentials:
-                              sslCredentials:
-                                rootCerts:
-                                  inlineBytes: Q0VSVElGSUNBVEU=
-                            statPrefix: sds_identity_cert
-                            targetUri: kuma-control-plane:5677
+                        - envoyGrpc:
+                            clusterName: ads_cluster
+                        transportApiVersion: V2
+                      resourceApiVersion: V2
                 requireClientCertificate: true
 `,
 			}),
@@ -136,31 +130,63 @@ var _ = Describe("CreateDownstreamTlsContext()", func() {
                         apiConfigSource:
                           apiType: GRPC
                           grpcServices:
-                          - googleGrpc:
-                              channelCredentials:
-                                sslCredentials:
-                                  rootCerts:
-                                    inlineBytes: Q0VSVElGSUNBVEU=
-                              statPrefix: sds_mesh_ca
-                              targetUri: kuma-control-plane:5677
+                          - envoyGrpc:
+                              clusterName: ads_cluster
+                          transportApiVersion: V2
+                        resourceApiVersion: V2
                   tlsCertificateSdsSecretConfigs:
                   - name: identity_cert
                     sdsConfig:
                       apiConfigSource:
                         apiType: GRPC
                         grpcServices:
-                        - googleGrpc:
-                            channelCredentials:
-                              sslCredentials:
-                                rootCerts:
-                                  inlineBytes: Q0VSVElGSUNBVEU=
-                            statPrefix: sds_identity_cert
-                            targetUri: kuma-control-plane:5677
+                        - envoyGrpc:
+                            clusterName: ads_cluster
+                        transportApiVersion: V2
+                      resourceApiVersion: V2
                 requireClientCertificate: true
 `,
 			}),
 			Entry("dataplane with a token", testCase{
-
+				metadata: &core_xds.DataplaneMetadata{
+					DataplaneToken: "sampletoken",
+				},
+				expected: `
+                commonTlsContext:
+                  combinedValidationContext:
+                    defaultValidationContext:
+                      matchSubjectAltNames:
+                      - prefix: spiffe://default/
+                    validationContextSdsSecretConfig:
+                      name: mesh_ca
+                      sdsConfig:
+                        apiConfigSource:
+                          apiType: GRPC
+                          grpcServices:
+                          - envoyGrpc:
+                              clusterName: ads_cluster
+                            initialMetadata:
+                            - key: authorization
+                              value: sampletoken
+                          transportApiVersion: V2
+                        resourceApiVersion: V2
+                  tlsCertificateSdsSecretConfigs:
+                  - name: identity_cert
+                    sdsConfig:
+                      apiConfigSource:
+                        apiType: GRPC
+                        grpcServices:
+                        - envoyGrpc:
+                            clusterName: ads_cluster
+                          initialMetadata:
+                          - key: authorization
+                            value: sampletoken
+                        transportApiVersion: V2
+                      resourceApiVersion: V2
+                requireClientCertificate: true
+`,
+			}),
+			Entry("dataplane with a token path", testCase{
 				metadata: &core_xds.DataplaneMetadata{
 					DataplaneTokenPath: "/path/to/token",
 				},
@@ -191,6 +217,8 @@ var _ = Describe("CreateDownstreamTlsContext()", func() {
                               credentialsFactoryName: envoy.grpc_credentials.file_based_metadata
                               statPrefix: sds_mesh_ca
                               targetUri: kuma-control-plane:5677
+                          transportApiVersion: V2
+                        resourceApiVersion: V2
                   tlsCertificateSdsSecretConfigs:
                   - name: identity_cert
                     sdsConfig:
@@ -212,6 +240,8 @@ var _ = Describe("CreateDownstreamTlsContext()", func() {
                             credentialsFactoryName: envoy.grpc_credentials.file_based_metadata
                             statPrefix: sds_identity_cert
                             targetUri: kuma-control-plane:5677
+                        transportApiVersion: V2
+                      resourceApiVersion: V2
                 requireClientCertificate: true
 `,
 			}),
@@ -305,26 +335,20 @@ var _ = Describe("CreateUpstreamTlsContext()", func() {
                         apiConfigSource:
                           apiType: GRPC
                           grpcServices:
-                          - googleGrpc:
-                              channelCredentials:
-                                sslCredentials:
-                                  rootCerts:
-                                    inlineBytes: Q0VSVElGSUNBVEU=
-                              statPrefix: sds_mesh_ca
-                              targetUri: kuma-control-plane:5677
+                          - envoyGrpc:
+                              clusterName: ads_cluster
+                          transportApiVersion: V2
+                        resourceApiVersion: V2
                   tlsCertificateSdsSecretConfigs:
                   - name: identity_cert
                     sdsConfig:
                       apiConfigSource:
                         apiType: GRPC
                         grpcServices:
-                        - googleGrpc:
-                            channelCredentials:
-                              sslCredentials:
-                                rootCerts:
-                                  inlineBytes: Q0VSVElGSUNBVEU=
-                            statPrefix: sds_identity_cert
-                            targetUri: kuma-control-plane:5677
+                        - envoyGrpc:
+                            clusterName: ads_cluster
+                        transportApiVersion: V2
+                      resourceApiVersion: V2
 `,
 			}),
 			Entry("dataplane without a token", testCase{
@@ -342,29 +366,62 @@ var _ = Describe("CreateUpstreamTlsContext()", func() {
                         apiConfigSource:
                           apiType: GRPC
                           grpcServices:
-                          - googleGrpc:
-                              channelCredentials:
-                                sslCredentials:
-                                  rootCerts:
-                                    inlineBytes: Q0VSVElGSUNBVEU=
-                              statPrefix: sds_mesh_ca
-                              targetUri: kuma-control-plane:5677
+                          - envoyGrpc:
+                              clusterName: ads_cluster
+                          transportApiVersion: V2
+                        resourceApiVersion: V2
                   tlsCertificateSdsSecretConfigs:
                   - name: identity_cert
                     sdsConfig:
                       apiConfigSource:
                         apiType: GRPC
                         grpcServices:
-                        - googleGrpc:
-                            channelCredentials:
-                              sslCredentials:
-                                rootCerts:
-                                  inlineBytes: Q0VSVElGSUNBVEU=
-                            statPrefix: sds_identity_cert
-                            targetUri: kuma-control-plane:5677
+                        - envoyGrpc:
+                            clusterName: ads_cluster
+                        transportApiVersion: V2
+                      resourceApiVersion: V2
 `,
 			}),
-			Entry("dataplane with a token", testCase{
+			Entry("dataplane with token", testCase{
+				metadata: &core_xds.DataplaneMetadata{
+					DataplaneToken: "sampletoken",
+				},
+				upstreamService: "backend",
+				expected: `
+                commonTlsContext:
+                  combinedValidationContext:
+                    defaultValidationContext:
+                      matchSubjectAltNames:
+                      - exact: spiffe://default/backend
+                    validationContextSdsSecretConfig:
+                      name: mesh_ca
+                      sdsConfig:
+                        apiConfigSource:
+                          apiType: GRPC
+                          grpcServices:
+                          - envoyGrpc:
+                              clusterName: ads_cluster
+                            initialMetadata:
+                            - key: authorization
+                              value: sampletoken
+                          transportApiVersion: V2
+                        resourceApiVersion: V2
+                  tlsCertificateSdsSecretConfigs:
+                  - name: identity_cert
+                    sdsConfig:
+                      apiConfigSource:
+                        apiType: GRPC
+                        grpcServices:
+                        - envoyGrpc:
+                            clusterName: ads_cluster
+                          initialMetadata:
+                          - key: authorization
+                            value: sampletoken
+                        transportApiVersion: V2
+                      resourceApiVersion: V2
+`,
+			}),
+			Entry("dataplane with a token path", testCase{
 				upstreamService: "backend",
 				metadata: &core_xds.DataplaneMetadata{
 					DataplaneTokenPath: "/path/to/token",
@@ -396,6 +453,8 @@ var _ = Describe("CreateUpstreamTlsContext()", func() {
                               credentialsFactoryName: envoy.grpc_credentials.file_based_metadata
                               statPrefix: sds_mesh_ca
                               targetUri: kuma-control-plane:5677
+                          transportApiVersion: V2
+                        resourceApiVersion: V2
                   tlsCertificateSdsSecretConfigs:
                   - name: identity_cert
                     sdsConfig:
@@ -417,6 +476,8 @@ var _ = Describe("CreateUpstreamTlsContext()", func() {
                             credentialsFactoryName: envoy.grpc_credentials.file_based_metadata
                             statPrefix: sds_identity_cert
                             targetUri: kuma-control-plane:5677
+                        transportApiVersion: V2
+                      resourceApiVersion: V2
 `,
 			}),
 		)
diff --git a/pkg/xds/envoy/tls/v3/tls_test.go b/pkg/xds/envoy/tls/v3/tls_test.go
index 971cea308..aa81ac0b6 100644
--- a/pkg/xds/envoy/tls/v3/tls_test.go
+++ b/pkg/xds/envoy/tls/v3/tls_test.go
@@ -99,13 +99,8 @@ var _ = Describe("CreateDownstreamTlsContext()", func() {
                         apiConfigSource:
                           apiType: GRPC
                           grpcServices:
-                          - googleGrpc:
-                              channelCredentials:
-                                sslCredentials:
-                                  rootCerts:
-                                    inlineBytes: Q0VSVElGSUNBVEU=
-                              statPrefix: sds_mesh_ca
-                              targetUri: kuma-control-plane:5677
+                          - envoyGrpc:
+                              clusterName: ads_cluster
                           transportApiVersion: V3
                         resourceApiVersion: V3
                   tlsCertificateSdsSecretConfigs:
@@ -114,13 +109,8 @@ var _ = Describe("CreateDownstreamTlsContext()", func() {
                       apiConfigSource:
                         apiType: GRPC
                         grpcServices:
-                        - googleGrpc:
-                            channelCredentials:
-                              sslCredentials:
-                                rootCerts:
-                                  inlineBytes: Q0VSVElGSUNBVEU=
-                            statPrefix: sds_identity_cert
-                            targetUri: kuma-control-plane:5677
+                        - envoyGrpc:
+                            clusterName: ads_cluster
                         transportApiVersion: V3
                       resourceApiVersion: V3
                 requireClientCertificate: true
@@ -140,13 +130,8 @@ var _ = Describe("CreateDownstreamTlsContext()", func() {
                         apiConfigSource:
                           apiType: GRPC
                           grpcServices:
-                          - googleGrpc:
-                              channelCredentials:
-                                sslCredentials:
-                                  rootCerts:
-                                    inlineBytes: Q0VSVElGSUNBVEU=
-                              statPrefix: sds_mesh_ca
-                              targetUri: kuma-control-plane:5677
+                          - envoyGrpc:
+                              clusterName: ads_cluster
                           transportApiVersion: V3
                         resourceApiVersion: V3
                   tlsCertificateSdsSecretConfigs:
@@ -155,19 +140,53 @@ var _ = Describe("CreateDownstreamTlsContext()", func() {
                       apiConfigSource:
                         apiType: GRPC
                         grpcServices:
-                        - googleGrpc:
-                            channelCredentials:
-                              sslCredentials:
-                                rootCerts:
-                                  inlineBytes: Q0VSVElGSUNBVEU=
-                            statPrefix: sds_identity_cert
-                            targetUri: kuma-control-plane:5677
+                        - envoyGrpc:
+                            clusterName: ads_cluster
                         transportApiVersion: V3
                       resourceApiVersion: V3
                 requireClientCertificate: true
 `,
 			}),
 			Entry("dataplane with a token", testCase{
+				metadata: &core_xds.DataplaneMetadata{
+					DataplaneToken: "sampletoken",
+				},
+				expected: `
+                commonTlsContext:
+                  combinedValidationContext:
+                    defaultValidationContext:
+                      matchSubjectAltNames:
+                      - prefix: spiffe://default/
+                    validationContextSdsSecretConfig:
+                      name: mesh_ca
+                      sdsConfig:
+                        apiConfigSource:
+                          apiType: GRPC
+                          grpcServices:
+                          - envoyGrpc:
+                              clusterName: ads_cluster
+                            initialMetadata:
+                            - key: authorization
+                              value: sampletoken
+                          transportApiVersion: V3
+                        resourceApiVersion: V3
+                  tlsCertificateSdsSecretConfigs:
+                  - name: identity_cert
+                    sdsConfig:
+                      apiConfigSource:
+                        apiType: GRPC
+                        grpcServices:
+                        - envoyGrpc:
+                            clusterName: ads_cluster
+                          initialMetadata:
+                          - key: authorization
+                            value: sampletoken
+                        transportApiVersion: V3
+                      resourceApiVersion: V3
+                requireClientCertificate: true
+`,
+			}),
+			Entry("dataplane with a token path", testCase{
 
 				metadata: &core_xds.DataplaneMetadata{
 					DataplaneTokenPath: "/path/to/token",
@@ -317,13 +336,8 @@ var _ = Describe("CreateUpstreamTlsContext()", func() {
                         apiConfigSource:
                           apiType: GRPC
                           grpcServices:
-                          - googleGrpc:
-                              channelCredentials:
-                                sslCredentials:
-                                  rootCerts:
-                                    inlineBytes: Q0VSVElGSUNBVEU=
-                              statPrefix: sds_mesh_ca
-                              targetUri: kuma-control-plane:5677
+                          - envoyGrpc:
+                              clusterName: ads_cluster
                           transportApiVersion: V3
                         resourceApiVersion: V3
                   tlsCertificateSdsSecretConfigs:
@@ -332,13 +346,8 @@ var _ = Describe("CreateUpstreamTlsContext()", func() {
                       apiConfigSource:
                         apiType: GRPC
                         grpcServices:
-                        - googleGrpc:
-                            channelCredentials:
-                              sslCredentials:
-                                rootCerts:
-                                  inlineBytes: Q0VSVElGSUNBVEU=
-                            statPrefix: sds_identity_cert
-                            targetUri: kuma-control-plane:5677
+                        - envoyGrpc:
+                            clusterName: ads_cluster
                         transportApiVersion: V3
                       resourceApiVersion: V3
 `,
@@ -358,13 +367,8 @@ var _ = Describe("CreateUpstreamTlsContext()", func() {
                         apiConfigSource:
                           apiType: GRPC
                           grpcServices:
-                          - googleGrpc:
-                              channelCredentials:
-                                sslCredentials:
-                                  rootCerts:
-                                    inlineBytes: Q0VSVElGSUNBVEU=
-                              statPrefix: sds_mesh_ca
-                              targetUri: kuma-control-plane:5677
+                          - envoyGrpc:
+                              clusterName: ads_cluster
                           transportApiVersion: V3
                         resourceApiVersion: V3
                   tlsCertificateSdsSecretConfigs:
@@ -373,18 +377,52 @@ var _ = Describe("CreateUpstreamTlsContext()", func() {
                       apiConfigSource:
                         apiType: GRPC
                         grpcServices:
-                        - googleGrpc:
-                            channelCredentials:
-                              sslCredentials:
-                                rootCerts:
-                                  inlineBytes: Q0VSVElGSUNBVEU=
-                            statPrefix: sds_identity_cert
-                            targetUri: kuma-control-plane:5677
+                        - envoyGrpc:
+                            clusterName: ads_cluster
                         transportApiVersion: V3
                       resourceApiVersion: V3
 `,
 			}),
-			Entry("dataplane with a token", testCase{
+			Entry("dataplane with token", testCase{
+				metadata: &core_xds.DataplaneMetadata{
+					DataplaneToken: "sampletoken",
+				},
+				upstreamService: "backend",
+				expected: `
+                commonTlsContext:
+                  combinedValidationContext:
+                    defaultValidationContext:
+                      matchSubjectAltNames:
+                      - exact: spiffe://default/backend
+                    validationContextSdsSecretConfig:
+                      name: mesh_ca
+                      sdsConfig:
+                        apiConfigSource:
+                          apiType: GRPC
+                          grpcServices:
+                          - envoyGrpc:
+                              clusterName: ads_cluster
+                            initialMetadata:
+                            - key: authorization
+                              value: sampletoken
+                          transportApiVersion: V3
+                        resourceApiVersion: V3
+                  tlsCertificateSdsSecretConfigs:
+                  - name: identity_cert
+                    sdsConfig:
+                      apiConfigSource:
+                        apiType: GRPC
+                        grpcServices:
+                        - envoyGrpc:
+                            clusterName: ads_cluster
+                          initialMetadata:
+                          - key: authorization
+                            value: sampletoken
+                        transportApiVersion: V3
+                      resourceApiVersion: V3
+`,
+			}),
+			Entry("dataplane with a token path", testCase{
 				upstreamService: "backend",
 				metadata: &core_xds.DataplaneMetadata{
 					DataplaneTokenPath: "/path/to/token",
diff --git a/pkg/xds/generator/testdata/inbound-proxy/3-envoy-config.golden.yaml b/pkg/xds/generator/testdata/inbound-proxy/3-envoy-config.golden.yaml
index 69d608656..50cfd6ccf 100644
--- a/pkg/xds/generator/testdata/inbound-proxy/3-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/inbound-proxy/3-envoy-config.golden.yaml
@@ -65,13 +65,8 @@ resources:
                   apiConfigSource:
                     apiType: GRPC
                     grpcServices:
-                    - googleGrpc:
-                        channelCredentials:
-                          sslCredentials:
-                            rootCerts:
-                              inlineBytes: MTIzNDU=
-                        statPrefix: sds_mesh_ca
-                        targetUri: kuma-system:5677
+                    - envoyGrpc:
+                        clusterName: ads_cluster
                     transportApiVersion: V3
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
@@ -80,13 +75,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_identity_cert
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           requireClientCertificate: true
@@ -162,13 +152,8 @@ resources:
                   apiConfigSource:
                     apiType: GRPC
                     grpcServices:
-                    - googleGrpc:
-                        channelCredentials:
-                          sslCredentials:
-                            rootCerts:
-                              inlineBytes: MTIzNDU=
-                        statPrefix: sds_mesh_ca
-                        targetUri: kuma-system:5677
+                    - envoyGrpc:
+                        clusterName: ads_cluster
                     transportApiVersion: V3
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
@@ -177,13 +162,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_identity_cert
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           requireClientCertificate: true
@@ -223,13 +203,8 @@ resources:
                   apiConfigSource:
                     apiType: GRPC
                     grpcServices:
-                    - googleGrpc:
-                        channelCredentials:
-                          sslCredentials:
-                            rootCerts:
-                              inlineBytes: MTIzNDU=
-                        statPrefix: sds_mesh_ca
-                        targetUri: kuma-system:5677
+                    - envoyGrpc:
+                        clusterName: ads_cluster
                     transportApiVersion: V3
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
@@ -238,13 +213,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_identity_cert
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           requireClientCertificate: true
@@ -300,13 +270,8 @@ resources:
                   apiConfigSource:
                     apiType: GRPC
                     grpcServices:
-                    - googleGrpc:
-                        channelCredentials:
-                          sslCredentials:
-                            rootCerts:
-                              inlineBytes: MTIzNDU=
-                        statPrefix: sds_mesh_ca
-                        targetUri: kuma-system:5677
+                    - envoyGrpc:
+                        clusterName: ads_cluster
                     transportApiVersion: V3
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
@@ -315,13 +280,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_identity_cert
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           requireClientCertificate: true
diff --git a/pkg/xds/generator/testdata/inbound-proxy/4-envoy-config.golden.yaml b/pkg/xds/generator/testdata/inbound-proxy/4-envoy-config.golden.yaml
index 12880bd9e..2c8c7be63 100644
--- a/pkg/xds/generator/testdata/inbound-proxy/4-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/inbound-proxy/4-envoy-config.golden.yaml
@@ -66,13 +66,8 @@ resources:
                   apiConfigSource:
                     apiType: GRPC
                     grpcServices:
-                    - googleGrpc:
-                        channelCredentials:
-                          sslCredentials:
-                            rootCerts:
-                              inlineBytes: MTIzNDU=
-                        statPrefix: sds_mesh_ca
-                        targetUri: kuma-system:5677
+                    - envoyGrpc:
+                        clusterName: ads_cluster
                     transportApiVersion: V3
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
@@ -81,13 +76,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_identity_cert
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           requireClientCertificate: true
@@ -164,13 +154,8 @@ resources:
                   apiConfigSource:
                     apiType: GRPC
                     grpcServices:
-                    - googleGrpc:
-                        channelCredentials:
-                          sslCredentials:
-                            rootCerts:
-                              inlineBytes: MTIzNDU=
-                        statPrefix: sds_mesh_ca
-                        targetUri: kuma-system:5677
+                    - envoyGrpc:
+                        clusterName: ads_cluster
                     transportApiVersion: V3
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
@@ -179,13 +164,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_identity_cert
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           requireClientCertificate: true
@@ -226,13 +206,8 @@ resources:
                   apiConfigSource:
                     apiType: GRPC
                     grpcServices:
-                    - googleGrpc:
-                        channelCredentials:
-                          sslCredentials:
-                            rootCerts:
-                              inlineBytes: MTIzNDU=
-                        statPrefix: sds_mesh_ca
-                        targetUri: kuma-system:5677
+                    - envoyGrpc:
+                        clusterName: ads_cluster
                     transportApiVersion: V3
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
@@ -241,13 +216,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_identity_cert
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           requireClientCertificate: true
@@ -304,13 +274,8 @@ resources:
                   apiConfigSource:
                     apiType: GRPC
                     grpcServices:
-                    - googleGrpc:
-                        channelCredentials:
-                          sslCredentials:
-                            rootCerts:
-                              inlineBytes: MTIzNDU=
-                        statPrefix: sds_mesh_ca
-                        targetUri: kuma-system:5677
+                    - envoyGrpc:
+                        clusterName: ads_cluster
                     transportApiVersion: V3
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
@@ -319,13 +284,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_identity_cert
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           requireClientCertificate: true
diff --git a/pkg/xds/generator/testdata/outbound-proxy/04.envoy.golden.yaml b/pkg/xds/generator/testdata/outbound-proxy/04.envoy.golden.yaml
index 7da0e2e3e..6e66648ef 100644
--- a/pkg/xds/generator/testdata/outbound-proxy/04.envoy.golden.yaml
+++ b/pkg/xds/generator/testdata/outbound-proxy/04.envoy.golden.yaml
@@ -140,13 +140,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_mesh_ca
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
@@ -155,13 +150,8 @@ resources:
               apiConfigSource:
                 apiType: GRPC
                 grpcServices:
-                - googleGrpc:
-                    channelCredentials:
-                      sslCredentials:
-                        rootCerts:
-                          inlineBytes: MTIzNDU=
-                    statPrefix: sds_identity_cert
-                    targetUri: kuma-system:5677
+                - envoyGrpc:
+                    clusterName: ads_cluster
                 transportApiVersion: V3
               resourceApiVersion: V3
         sni: api-http{mesh=mesh1}
@@ -194,13 +184,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_mesh_ca
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
@@ -209,13 +194,8 @@ resources:
               apiConfigSource:
                 apiType: GRPC
                 grpcServices:
-                - googleGrpc:
-                    channelCredentials:
-                      sslCredentials:
-                        rootCerts:
-                          inlineBytes: MTIzNDU=
-                    statPrefix: sds_identity_cert
-                    targetUri: kuma-system:5677
+                - envoyGrpc:
+                    clusterName: ads_cluster
                 transportApiVersion: V3
               resourceApiVersion: V3
         sni: api-tcp{mesh=mesh1}
@@ -246,13 +226,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_mesh_ca
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
@@ -261,13 +236,8 @@ resources:
               apiConfigSource:
                 apiType: GRPC
                 grpcServices:
-                - googleGrpc:
-                    channelCredentials:
-                      sslCredentials:
-                        rootCerts:
-                          inlineBytes: MTIzNDU=
-                    statPrefix: sds_identity_cert
-                    targetUri: kuma-system:5677
+                - envoyGrpc:
+                    clusterName: ads_cluster
                 transportApiVersion: V3
               resourceApiVersion: V3
         sni: backend{mesh=mesh1}
@@ -307,13 +277,8 @@ resources:
                   apiConfigSource:
                     apiType: GRPC
                     grpcServices:
-                    - googleGrpc:
-                        channelCredentials:
-                          sslCredentials:
-                            rootCerts:
-                              inlineBytes: MTIzNDU=
-                        statPrefix: sds_mesh_ca
-                        targetUri: kuma-system:5677
+                    - envoyGrpc:
+                        clusterName: ads_cluster
                     transportApiVersion: V3
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
@@ -322,13 +287,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_identity_cert
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           sni: db{mesh=mesh1,role=master}
@@ -350,13 +310,8 @@ resources:
                   apiConfigSource:
                     apiType: GRPC
                     grpcServices:
-                    - googleGrpc:
-                        channelCredentials:
-                          sslCredentials:
-                            rootCerts:
-                              inlineBytes: MTIzNDU=
-                        statPrefix: sds_mesh_ca
-                        targetUri: kuma-system:5677
+                    - envoyGrpc:
+                        clusterName: ads_cluster
                     transportApiVersion: V3
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
@@ -365,13 +320,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_identity_cert
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           sni: db{mesh=mesh1,role=replica}
diff --git a/pkg/xds/generator/testdata/profile-source/1-envoy-config.golden.yaml b/pkg/xds/generator/testdata/profile-source/1-envoy-config.golden.yaml
index baa7bfeb5..e86d062d1 100644
--- a/pkg/xds/generator/testdata/profile-source/1-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/profile-source/1-envoy-config.golden.yaml
@@ -54,13 +54,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_mesh_ca
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
@@ -69,13 +64,8 @@ resources:
               apiConfigSource:
                 apiType: GRPC
                 grpcServices:
-                - googleGrpc:
-                    channelCredentials:
-                      sslCredentials:
-                        rootCerts:
-                          inlineBytes: MTIzNDU=
-                    statPrefix: sds_identity_cert
-                    targetUri: kuma-system:5677
+                - envoyGrpc:
+                    clusterName: ads_cluster
                 transportApiVersion: V3
               resourceApiVersion: V3
         sni: db{mesh=demo}
@@ -111,13 +101,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_mesh_ca
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
@@ -126,13 +111,8 @@ resources:
               apiConfigSource:
                 apiType: GRPC
                 grpcServices:
-                - googleGrpc:
-                    channelCredentials:
-                      sslCredentials:
-                        rootCerts:
-                          inlineBytes: MTIzNDU=
-                    statPrefix: sds_identity_cert
-                    targetUri: kuma-system:5677
+                - envoyGrpc:
+                    clusterName: ads_cluster
                 transportApiVersion: V3
               resourceApiVersion: V3
         sni: elastic{mesh=demo}
@@ -203,13 +183,8 @@ resources:
                   apiConfigSource:
                     apiType: GRPC
                     grpcServices:
-                    - googleGrpc:
-                        channelCredentials:
-                          sslCredentials:
-                            rootCerts:
-                              inlineBytes: MTIzNDU=
-                        statPrefix: sds_mesh_ca
-                        targetUri: kuma-system:5677
+                    - envoyGrpc:
+                        clusterName: ads_cluster
                     transportApiVersion: V3
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
@@ -218,13 +193,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_identity_cert
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           requireClientCertificate: true
diff --git a/pkg/xds/generator/testdata/profile-source/2-envoy-config.golden.yaml b/pkg/xds/generator/testdata/profile-source/2-envoy-config.golden.yaml
index 1e85bd7b9..f11d408cf 100644
--- a/pkg/xds/generator/testdata/profile-source/2-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/profile-source/2-envoy-config.golden.yaml
@@ -54,13 +54,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_mesh_ca
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
@@ -69,13 +64,8 @@ resources:
               apiConfigSource:
                 apiType: GRPC
                 grpcServices:
-                - googleGrpc:
-                    channelCredentials:
-                      sslCredentials:
-                        rootCerts:
-                          inlineBytes: MTIzNDU=
-                    statPrefix: sds_identity_cert
-                    targetUri: kuma-system:5677
+                - envoyGrpc:
+                    clusterName: ads_cluster
                 transportApiVersion: V3
               resourceApiVersion: V3
         sni: db{mesh=demo}
@@ -111,13 +101,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_mesh_ca
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
@@ -126,13 +111,8 @@ resources:
               apiConfigSource:
                 apiType: GRPC
                 grpcServices:
-                - googleGrpc:
-                    channelCredentials:
-                      sslCredentials:
-                        rootCerts:
-                          inlineBytes: MTIzNDU=
-                    statPrefix: sds_identity_cert
-                    targetUri: kuma-system:5677
+                - envoyGrpc:
+                    clusterName: ads_cluster
                 transportApiVersion: V3
               resourceApiVersion: V3
         sni: elastic{mesh=demo}
@@ -224,13 +204,8 @@ resources:
                   apiConfigSource:
                     apiType: GRPC
                     grpcServices:
-                    - googleGrpc:
-                        channelCredentials:
-                          sslCredentials:
-                            rootCerts:
-                              inlineBytes: MTIzNDU=
-                        statPrefix: sds_mesh_ca
-                        targetUri: kuma-system:5677
+                    - envoyGrpc:
+                        clusterName: ads_cluster
                     transportApiVersion: V3
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
@@ -239,13 +214,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_identity_cert
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           requireClientCertificate: true
diff --git a/pkg/xds/generator/testdata/profile-source/3-envoy-config.golden.yaml b/pkg/xds/generator/testdata/profile-source/3-envoy-config.golden.yaml
index 075b61f97..aa45c84c2 100644
--- a/pkg/xds/generator/testdata/profile-source/3-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/profile-source/3-envoy-config.golden.yaml
@@ -54,13 +54,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_mesh_ca
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
@@ -69,13 +64,8 @@ resources:
               apiConfigSource:
                 apiType: GRPC
                 grpcServices:
-                - googleGrpc:
-                    channelCredentials:
-                      sslCredentials:
-                        rootCerts:
-                          inlineBytes: MTIzNDU=
-                    statPrefix: sds_identity_cert
-                    targetUri: kuma-system:5677
+                - envoyGrpc:
+                    clusterName: ads_cluster
                 transportApiVersion: V3
               resourceApiVersion: V3
         sni: db{mesh=demo}
@@ -111,13 +101,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_mesh_ca
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
@@ -126,13 +111,8 @@ resources:
               apiConfigSource:
                 apiType: GRPC
                 grpcServices:
-                - googleGrpc:
-                    channelCredentials:
-                      sslCredentials:
-                        rootCerts:
-                          inlineBytes: MTIzNDU=
-                    statPrefix: sds_identity_cert
-                    targetUri: kuma-system:5677
+                - envoyGrpc:
+                    clusterName: ads_cluster
                 transportApiVersion: V3
               resourceApiVersion: V3
         sni: elastic{mesh=demo}
@@ -219,13 +199,8 @@ resources:
                   apiConfigSource:
                     apiType: GRPC
                     grpcServices:
-                    - googleGrpc:
-                        channelCredentials:
-                          sslCredentials:
-                            rootCerts:
-                              inlineBytes: MTIzNDU=
-                        statPrefix: sds_mesh_ca
-                        targetUri: kuma-system:5677
+                    - envoyGrpc:
+                        clusterName: ads_cluster
                     transportApiVersion: V3
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
@@ -234,13 +209,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_identity_cert
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           requireClientCertificate: true
@@ -384,13 +354,8 @@ resources:
                   apiConfigSource:
                     apiType: GRPC
                     grpcServices:
-                    - googleGrpc:
-                        channelCredentials:
-                          sslCredentials:
-                            rootCerts:
-                              inlineBytes: MTIzNDU=
-                        statPrefix: sds_mesh_ca
-                        targetUri: kuma-system:5677
+                    - envoyGrpc:
+                        clusterName: ads_cluster
                     transportApiVersion: V3
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
@@ -399,13 +364,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_identity_cert
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           requireClientCertificate: true
diff --git a/pkg/xds/generator/testdata/profile-source/4-envoy-config.golden.yaml b/pkg/xds/generator/testdata/profile-source/4-envoy-config.golden.yaml
index 0807313a1..c9d39124e 100644
--- a/pkg/xds/generator/testdata/profile-source/4-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/profile-source/4-envoy-config.golden.yaml
@@ -54,13 +54,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_mesh_ca
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
@@ -69,13 +64,8 @@ resources:
               apiConfigSource:
                 apiType: GRPC
                 grpcServices:
-                - googleGrpc:
-                    channelCredentials:
-                      sslCredentials:
-                        rootCerts:
-                          inlineBytes: MTIzNDU=
-                    statPrefix: sds_identity_cert
-                    targetUri: kuma-system:5677
+                - envoyGrpc:
+                    clusterName: ads_cluster
                 transportApiVersion: V3
               resourceApiVersion: V3
         sni: db{mesh=demo}
@@ -111,13 +101,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_mesh_ca
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           tlsCertificateSdsSecretConfigs:
@@ -126,13 +111,8 @@ resources:
               apiConfigSource:
                 apiType: GRPC
                 grpcServices:
-                - googleGrpc:
-                    channelCredentials:
-                      sslCredentials:
-                        rootCerts:
-                          inlineBytes: MTIzNDU=
-                    statPrefix: sds_identity_cert
-                    targetUri: kuma-system:5677
+                - envoyGrpc:
+                    clusterName: ads_cluster
                 transportApiVersion: V3
               resourceApiVersion: V3
         sni: elastic{mesh=demo}
@@ -240,13 +220,8 @@ resources:
                   apiConfigSource:
                     apiType: GRPC
                     grpcServices:
-                    - googleGrpc:
-                        channelCredentials:
-                          sslCredentials:
-                            rootCerts:
-                              inlineBytes: MTIzNDU=
-                        statPrefix: sds_mesh_ca
-                        targetUri: kuma-system:5677
+                    - envoyGrpc:
+                        clusterName: ads_cluster
                     transportApiVersion: V3
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
@@ -255,13 +230,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_identity_cert
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           requireClientCertificate: true
@@ -422,13 +392,8 @@ resources:
                   apiConfigSource:
                     apiType: GRPC
                     grpcServices:
-                    - googleGrpc:
-                        channelCredentials:
-                          sslCredentials:
-                            rootCerts:
-                              inlineBytes: MTIzNDU=
-                        statPrefix: sds_mesh_ca
-                        targetUri: kuma-system:5677
+                    - envoyGrpc:
+                        clusterName: ads_cluster
                     transportApiVersion: V3
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
@@ -437,13 +402,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_identity_cert
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           requireClientCertificate: true
diff --git a/pkg/xds/generator/testdata/prometheus-endpoint/default-mtls.envoy-config.golden.yaml b/pkg/xds/generator/testdata/prometheus-endpoint/default-mtls.envoy-config.golden.yaml
index 048f85d88..37fc2660a 100644
--- a/pkg/xds/generator/testdata/prometheus-endpoint/default-mtls.envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/prometheus-endpoint/default-mtls.envoy-config.golden.yaml
@@ -69,13 +69,8 @@ resources:
                   apiConfigSource:
                     apiType: GRPC
                     grpcServices:
-                    - googleGrpc:
-                        channelCredentials:
-                          sslCredentials:
-                            rootCerts:
-                              inlineBytes: MTIzNDU=
-                        statPrefix: sds_mesh_ca
-                        targetUri: kuma-system:5677
+                    - envoyGrpc:
+                        clusterName: ads_cluster
                     transportApiVersion: V3
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
@@ -84,13 +79,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_identity_cert
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           requireClientCertificate: true
diff --git a/pkg/xds/generator/testdata/template-proxy/1-envoy-config.golden.yaml b/pkg/xds/generator/testdata/template-proxy/1-envoy-config.golden.yaml
index 1e88e62dd..30acec79d 100644
--- a/pkg/xds/generator/testdata/template-proxy/1-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/template-proxy/1-envoy-config.golden.yaml
@@ -86,13 +86,8 @@ resources:
                   apiConfigSource:
                     apiType: GRPC
                     grpcServices:
-                    - googleGrpc:
-                        channelCredentials:
-                          sslCredentials:
-                            rootCerts:
-                              inlineBytes: MTIzNDU=
-                        statPrefix: sds_mesh_ca
-                        targetUri: kuma-system:5677
+                    - envoyGrpc:
+                        clusterName: ads_cluster
                     transportApiVersion: V3
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
@@ -101,13 +96,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_identity_cert
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           requireClientCertificate: true
diff --git a/pkg/xds/server/v2/testdata/envoy-config.golden.yaml b/pkg/xds/server/v2/testdata/envoy-config.golden.yaml
index 5dd227753..0b3827e40 100644
--- a/pkg/xds/server/v2/testdata/envoy-config.golden.yaml
+++ b/pkg/xds/server/v2/testdata/envoy-config.golden.yaml
@@ -87,26 +87,20 @@ resources:
                   apiConfigSource:
                     apiType: GRPC
                     grpcServices:
-                    - googleGrpc:
-                        channelCredentials:
-                          sslCredentials:
-                            rootCerts:
-                              inlineBytes: MTIzNDU=
-                        statPrefix: sds_mesh_ca
-                        targetUri: kuma-system:5677
+                    - envoyGrpc:
+                        clusterName: ads_cluster
+                    transportApiVersion: V2
+                  resourceApiVersion: V2
             tlsCertificateSdsSecretConfigs:
             - name: identity_cert
               sdsConfig:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_identity_cert
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
+                  transportApiVersion: V2
+                resourceApiVersion: V2
           requireClientCertificate: true
     name: inbound:192.168.0.1:443
     trafficDirection: INBOUND
@@ -154,26 +148,20 @@ resources:
                   apiConfigSource:
                     apiType: GRPC
                     grpcServices:
-                    - googleGrpc:
-                        channelCredentials:
-                          sslCredentials:
-                            rootCerts:
-                              inlineBytes: MTIzNDU=
-                        statPrefix: sds_mesh_ca
-                        targetUri: kuma-system:5677
+                    - envoyGrpc:
+                        clusterName: ads_cluster
+                    transportApiVersion: V2
+                  resourceApiVersion: V2
             tlsCertificateSdsSecretConfigs:
             - name: identity_cert
               sdsConfig:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_identity_cert
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
+                  transportApiVersion: V2
+                resourceApiVersion: V2
           requireClientCertificate: true
     name: inbound:192.168.0.1:80
     trafficDirection: INBOUND
@@ -213,26 +201,20 @@ resources:
                   apiConfigSource:
                     apiType: GRPC
                     grpcServices:
-                    - googleGrpc:
-                        channelCredentials:
-                          sslCredentials:
-                            rootCerts:
-                              inlineBytes: MTIzNDU=
-                        statPrefix: sds_mesh_ca
-                        targetUri: kuma-system:5677
+                    - envoyGrpc:
+                        clusterName: ads_cluster
+                    transportApiVersion: V2
+                  resourceApiVersion: V2
             tlsCertificateSdsSecretConfigs:
             - name: identity_cert
               sdsConfig:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_identity_cert
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
+                  transportApiVersion: V2
+                resourceApiVersion: V2
           requireClientCertificate: true
     name: inbound:192.168.0.2:443
     trafficDirection: INBOUND
@@ -272,26 +254,20 @@ resources:
                   apiConfigSource:
                     apiType: GRPC
                     grpcServices:
-                    - googleGrpc:
-                        channelCredentials:
-                          sslCredentials:
-                            rootCerts:
-                              inlineBytes: MTIzNDU=
-                        statPrefix: sds_mesh_ca
-                        targetUri: kuma-system:5677
+                    - envoyGrpc:
+                        clusterName: ads_cluster
+                    transportApiVersion: V2
+                  resourceApiVersion: V2
             tlsCertificateSdsSecretConfigs:
             - name: identity_cert
               sdsConfig:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_identity_cert
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
+                  transportApiVersion: V2
+                resourceApiVersion: V2
           requireClientCertificate: true
     name: inbound:192.168.0.2:80
     trafficDirection: INBOUND
diff --git a/pkg/xds/server/v3/testdata/envoy-config.golden.yaml b/pkg/xds/server/v3/testdata/envoy-config.golden.yaml
index 7148c105a..b6f24a414 100644
--- a/pkg/xds/server/v3/testdata/envoy-config.golden.yaml
+++ b/pkg/xds/server/v3/testdata/envoy-config.golden.yaml
@@ -86,13 +86,8 @@ resources:
                   apiConfigSource:
                     apiType: GRPC
                     grpcServices:
-                    - googleGrpc:
-                        channelCredentials:
-                          sslCredentials:
-                            rootCerts:
-                              inlineBytes: MTIzNDU=
-                        statPrefix: sds_mesh_ca
-                        targetUri: kuma-system:5677
+                    - envoyGrpc:
+                        clusterName: ads_cluster
                     transportApiVersion: V3
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
@@ -101,13 +96,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_identity_cert
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           requireClientCertificate: true
@@ -156,13 +146,8 @@ resources:
                   apiConfigSource:
                     apiType: GRPC
                     grpcServices:
-                    - googleGrpc:
-                        channelCredentials:
-                          sslCredentials:
-                            rootCerts:
-                              inlineBytes: MTIzNDU=
-                        statPrefix: sds_mesh_ca
-                        targetUri: kuma-system:5677
+                    - envoyGrpc:
+                        clusterName: ads_cluster
                     transportApiVersion: V3
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
@@ -171,13 +156,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_identity_cert
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           requireClientCertificate: true
@@ -218,13 +198,8 @@ resources:
                   apiConfigSource:
                     apiType: GRPC
                     grpcServices:
-                    - googleGrpc:
-                        channelCredentials:
-                          sslCredentials:
-                            rootCerts:
-                              inlineBytes: MTIzNDU=
-                        statPrefix: sds_mesh_ca
-                        targetUri: kuma-system:5677
+                    - envoyGrpc:
+                        clusterName: ads_cluster
                     transportApiVersion: V3
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
@@ -233,13 +208,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_identity_cert
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           requireClientCertificate: true
@@ -280,13 +250,8 @@ resources:
                   apiConfigSource:
                     apiType: GRPC
                     grpcServices:
-                    - googleGrpc:
-                        channelCredentials:
-                          sslCredentials:
-                            rootCerts:
-                              inlineBytes: MTIzNDU=
-                        statPrefix: sds_mesh_ca
-                        targetUri: kuma-system:5677
+                    - envoyGrpc:
+                        clusterName: ads_cluster
                     transportApiVersion: V3
                   resourceApiVersion: V3
             tlsCertificateSdsSecretConfigs:
@@ -295,13 +260,8 @@ resources:
                 apiConfigSource:
                   apiType: GRPC
                   grpcServices:
-                  - googleGrpc:
-                      channelCredentials:
-                        sslCredentials:
-                          rootCerts:
-                            inlineBytes: MTIzNDU=
-                      statPrefix: sds_identity_cert
-                      targetUri: kuma-system:5677
+                  - envoyGrpc:
+                      clusterName: ads_cluster
                   transportApiVersion: V3
                 resourceApiVersion: V3
           requireClientCertificate: true