xds: remove deprecated usages of xDS (#9602)

Note that this does NOT upgrade to xDS v3. That will come in a future PR. Additionally: - Ignored staticcheck warnings about how github.com/golang/protobuf is deprecated. - Shuffled some agent/xds imports in advance of a later xDS v3 upgrade. - Remove support for envoy 1.13.x but don't add in 1.17.x yet. We have to wait until the xDS v3 support is added in a follow-up PR. Fixes #8425
2021-02-22 15:00:15 -06:00 · 2021-02-22 15:00:15 -06:00 · cdc5e99184
parent b8f228781a
commit cdc5e99184
518 changed files with 18335 additions and 32200 deletions
--- a/.changelog/9602.txt
+++ b/.changelog/9602.txt
@ -0,0 +1,3 @@
+```release-note:improvement
+xds: remove deprecated usages of xDS and drop support for envoy 1.13.x
+```
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@ -779,14 +779,14 @@ jobs:
          command: bash <(curl -s https://codecov.io/bash) -v -c -C $CIRCLE_SHA1 -F ui
      - run: *notify-slack-failure

-  envoy-integration-test-1_13_7: &ENVOY_TESTS
+  envoy-integration-test-1_14_6: &ENVOY_TESTS
    docker:
      # We only really need bash and docker-compose which is installed on all
      # Circle images but pick Go since we have to pick one of them.
      - image: *GOLANG_IMAGE
    parallelism: 2
    environment:
-      ENVOY_VERSION: "1.13.7"
+      ENVOY_VERSION: "1.14.6"
    steps: &ENVOY_INTEGRATION_TEST_STEPS
      - checkout
      # Get go binary from workspace
@ -819,11 +819,6 @@ jobs:
          path: *TEST_RESULTS_DIR
      - run: *notify-slack-failure

-  envoy-integration-test-1_14_6:
-    <<: *ENVOY_TESTS
-    environment:
-      ENVOY_VERSION: "1.14.6"
-
  envoy-integration-test-1_15_3:
    <<: *ENVOY_TESTS
    environment:
@ -834,6 +829,8 @@ jobs:
    environment:
      ENVOY_VERSION: "1.16.2"

+  # TODO(rb): add in 1.17.0 support when v3 is ready
+
  # run integration tests for the connect ca providers
  test-connect-ca-providers:
    docker:
@ -1042,9 +1039,6 @@ workflows:
      - nomad-integration-0_8:
          requires:
            - dev-build
-      - envoy-integration-test-1_13_7:
-          requires:
-            - dev-build
      - envoy-integration-test-1_14_6:
          requires:
            - dev-build
@ -1054,6 +1048,8 @@ workflows:
      - envoy-integration-test-1_16_2:
          requires:
            - dev-build
+  # TODO(rb): add in 1.17.0 support when v3 is ready
+
  website:
    unless: << pipeline.parameters.trigger-load-test >>
    jobs:
--- a/.golangci.yml
+++ b/.golangci.yml
@ -19,6 +19,12 @@ issues:
    - linters: [staticcheck]
      text: 'SA9004:'

+    - linters: [staticcheck]
+      text: 'SA1019: Package github.com/golang/protobuf/jsonpb is deprecated'
+
+    - linters: [staticcheck]
+      text: 'SA1019: Package github.com/golang/protobuf/proto is deprecated'
+
    # An argument that always receives the same value is often not a problem.
    - linters: [unparam]
      text: 'always receives'
--- a/agent/xds/clusters.go
+++ b/agent/xds/clusters.go
@ -12,11 +12,13 @@ import (
 	envoycore "github.com/envoyproxy/go-control-plane/envoy/api/v2/core"
 	envoyendpoint "github.com/envoyproxy/go-control-plane/envoy/api/v2/endpoint"
 	envoytype "github.com/envoyproxy/go-control-plane/envoy/type"
+
 	"github.com/golang/protobuf/jsonpb"
 	"github.com/golang/protobuf/proto"
 	"github.com/golang/protobuf/ptypes"
 	"github.com/golang/protobuf/ptypes/any"
 	"github.com/golang/protobuf/ptypes/wrappers"
+
 	"github.com/hashicorp/consul/agent/connect"
 	"github.com/hashicorp/consul/agent/proxycfg"
 	"github.com/hashicorp/consul/agent/structs"
@ -270,13 +272,18 @@ func (s *Server) injectGatewayServiceAddons(cfgSnap *proxycfg.ConfigSnapshot, c
 	case structs.ServiceKindTerminatingGateway:
 		// Context used for TLS origination to the cluster
 		if mapping, ok := cfgSnap.TerminatingGateway.GatewayServices[svc]; ok && mapping.CAFile != "" {
-			context := envoyauth.UpstreamTlsContext{
+			tlsContext := &envoyauth.UpstreamTlsContext{
 				CommonTlsContext: makeCommonTLSContextFromFiles(mapping.CAFile, mapping.CertFile, mapping.KeyFile),
 			}
 			if mapping.SNI != "" {
-				context.Sni = mapping.SNI
+				tlsContext.Sni = mapping.SNI
 			}
-			c.TlsContext = &context
+
+			transportSocket, err := makeUpstreamTLSTransportSocket(tlsContext)
+			if err != nil {
+				return err
+			}
+			c.TransportSocket = transportSocket
 		}
 		if err := injectLBToCluster(lb, c); err != nil {
 			return fmt.Errorf("failed to apply load balancer configuration to cluster %q: %v", c.Name, err)
@ -418,11 +425,17 @@ func (s *Server) makeUpstreamClusterForPreparedQuery(upstream structs.Upstream,
 	}

 	// Enable TLS upstream with the configured client certificate.
-	c.TlsContext = &envoyauth.UpstreamTlsContext{
+	tlsContext := &envoyauth.UpstreamTlsContext{
 		CommonTlsContext: makeCommonTLSContextFromLeaf(cfgSnap, cfgSnap.Leaf()),
 		Sni:              sni,
 	}

+	transportSocket, err := makeUpstreamTLSTransportSocket(tlsContext)
+	if err != nil {
+		return nil, err
+	}
+	c.TransportSocket = transportSocket
+
 	return c, nil
 }

@ -536,11 +549,17 @@ func (s *Server) makeUpstreamClustersForDiscoveryChain(
 		}

 		// Enable TLS upstream with the configured client certificate.
-		c.TlsContext = &envoyauth.UpstreamTlsContext{
+		tlsContext := &envoyauth.UpstreamTlsContext{
 			CommonTlsContext: makeCommonTLSContextFromLeaf(cfgSnap, cfgSnap.Leaf()),
 			Sni:              sni,
 		}

+		transportSocket, err := makeUpstreamTLSTransportSocket(tlsContext)
+		if err != nil {
+			return nil, err
+		}
+		c.TransportSocket = transportSocket
+
 		out = append(out, c)
 	}

@ -551,7 +570,7 @@ func (s *Server) makeUpstreamClustersForDiscoveryChain(
 		defaultCluster := out[0]

 		// Overlay what the user provided.
-		escapeHatchCluster.TlsContext = defaultCluster.TlsContext
+		escapeHatchCluster.TransportSocket = defaultCluster.TransportSocket

 		out = []*envoy.Cluster{escapeHatchCluster}
 	}
@ -726,18 +745,6 @@ func (s *Server) makeGatewayCluster(snap *proxycfg.ConfigSnapshot, opts gatewayC
 	return cluster
 }

-// injectTerminatingGatewayTLSContext adds an UpstreamTlsContext to a cluster for TLS origination
-func injectTerminatingGatewayTLSContext(cfgSnap *proxycfg.ConfigSnapshot, cluster *envoy.Cluster, service structs.ServiceName) {
-	if mapping, ok := cfgSnap.TerminatingGateway.GatewayServices[service]; ok && mapping.CAFile != "" {
-		cluster.TlsContext = &envoyauth.UpstreamTlsContext{
-			CommonTlsContext: makeCommonTLSContextFromFiles(mapping.CAFile, mapping.CertFile, mapping.KeyFile),
-
-			// TODO (gateways) (freddy) If mapping.SNI is empty, does Envoy behave any differently if TlsContext.Sni is excluded?
-			Sni: mapping.SNI,
-		}
-	}
-}
-
 func makeThresholdsIfNeeded(limits UpstreamLimits) []*envoycluster.CircuitBreakers_Thresholds {
 	var empty UpstreamLimits
 	// Make sure to not create any thresholds when passed the zero-value in order
--- a/agent/xds/clusters_test.go
+++ b/agent/xds/clusters_test.go
@ -9,6 +9,7 @@ import (
 	"time"

 	envoy "github.com/envoyproxy/go-control-plane/envoy/api/v2"
+
 	"github.com/golang/protobuf/ptypes/wrappers"
 	testinf "github.com/mitchellh/go-testing-interface"
 	"github.com/stretchr/testify/require"
@ -45,19 +46,6 @@ func TestClustersFromSnapshot(t *testing.T) {
 				snap.Proxy.Config["envoy_local_cluster_json"] =
 					customAppClusterJSON(t, customClusterJSONOptions{
 						Name: "mylocal",
-						IncludeType: false,
-					})
-			},
-		},
-		{
-			name:               "custom-local-app-typed",
-			create:             proxycfg.TestConfigSnapshot,
-			overrideGoldenName: "custom-local-app",
-			setup: func(snap *proxycfg.ConfigSnapshot) {
-				snap.Proxy.Config["envoy_local_cluster_json"] =
-					customAppClusterJSON(t, customClusterJSONOptions{
-						Name:        "mylocal",
-						IncludeType: true,
 					})
 			},
 		},
@ -68,7 +56,6 @@ func TestClustersFromSnapshot(t *testing.T) {
 				snap.Proxy.Upstreams[0].Config["envoy_cluster_json"] =
 					customAppClusterJSON(t, customClusterJSONOptions{
 						Name: "myservice",
-						IncludeType: false,
 					})
 			},
 		},
@ -79,19 +66,6 @@ func TestClustersFromSnapshot(t *testing.T) {
 				snap.Proxy.Upstreams[0].Config["envoy_cluster_json"] =
 					customAppClusterJSON(t, customClusterJSONOptions{
 						Name: "myservice",
-						IncludeType: false,
-					})
-			},
-		},
-		{
-			name:               "custom-upstream-typed",
-			create:             proxycfg.TestConfigSnapshot,
-			overrideGoldenName: "custom-upstream",
-			setup: func(snap *proxycfg.ConfigSnapshot) {
-				snap.Proxy.Upstreams[0].Config["envoy_cluster_json"] =
-					customAppClusterJSON(t, customClusterJSONOptions{
-						Name:        "myservice",
-						IncludeType: true,
 					})
 			},
 		},
@ -103,9 +77,8 @@ func TestClustersFromSnapshot(t *testing.T) {
 				snap.Proxy.Upstreams[0].Config["envoy_cluster_json"] =
 					customAppClusterJSON(t, customClusterJSONOptions{
 						Name: "myservice",
-						IncludeType: true,
 						// Attempt to override the TLS context should be ignored
-						TLSContext: `{"commonTlsContext": {}}`,
+						TLSContext: `"allowRenegotiation": false`,
 					})
 			},
 		},
@ -745,7 +718,7 @@ func expectClustersJSONResources(snap *proxycfg.ConfigSnapshot) map[string]strin
 					"healthyPanicThreshold": {}
 				},
 				"connectTimeout": "5s",
-				"tlsContext": ` + expectedUpstreamTLSContextJSON(snap, "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul") + `
+				"transportSocket": ` + expectedUpstreamTransportSocketJSON(snap, "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul") + `
 			}`,
 		"prepared_query:geo-cache": `
 			{
@ -766,7 +739,7 @@ func expectClustersJSONResources(snap *proxycfg.ConfigSnapshot) map[string]strin

 				},
 				"connectTimeout": "5s",
-				"tlsContext": ` + expectedUpstreamTLSContextJSON(snap, "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul") + `
+				"transportSocket": ` + expectedUpstreamTransportSocketJSON(snap, "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul") + `
 			}`,
 	}
 }
@ -805,16 +778,19 @@ func expectClustersJSON(snap *proxycfg.ConfigSnapshot, v, n uint64) string {

 type customClusterJSONOptions struct {
 	Name       string
-	IncludeType bool
 	TLSContext string
 }

 var customAppClusterJSONTpl = `{
-	{{ if .IncludeType -}}
 	"@type": "type.googleapis.com/envoy.api.v2.Cluster",
-	{{- end }}
 	{{ if .TLSContext -}}
-	"tlsContext": {{ .TLSContext }},
+	"transport_socket": {
+		"name": "tls",
+		"typed_config": {
+			"@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
+			{{ .TLSContext }}
+		}
+	},
 	{{- end }}
 	"name": "{{ .Name }}",
 	"connectTimeout": "15s",
@ -858,35 +834,35 @@ func TestEnvoyLBConfig_InjectToCluster(t *testing.T) {
 	var tests = []struct {
 		name     string
 		lb       *structs.LoadBalancer
-		expected envoy.Cluster
+		expected *envoy.Cluster
 	}{
 		{
 			name: "skip empty",
 			lb: &structs.LoadBalancer{
 				Policy: "",
 			},
-			expected: envoy.Cluster{},
+			expected: &envoy.Cluster{},
 		},
 		{
 			name: "round robin",
 			lb: &structs.LoadBalancer{
 				Policy: structs.LBPolicyRoundRobin,
 			},
-			expected: envoy.Cluster{LbPolicy: envoy.Cluster_ROUND_ROBIN},
+			expected: &envoy.Cluster{LbPolicy: envoy.Cluster_ROUND_ROBIN},
 		},
 		{
 			name: "random",
 			lb: &structs.LoadBalancer{
 				Policy: structs.LBPolicyRandom,
 			},
-			expected: envoy.Cluster{LbPolicy: envoy.Cluster_RANDOM},
+			expected: &envoy.Cluster{LbPolicy: envoy.Cluster_RANDOM},
 		},
 		{
 			name: "maglev",
 			lb: &structs.LoadBalancer{
 				Policy: structs.LBPolicyMaglev,
 			},
-			expected: envoy.Cluster{LbPolicy: envoy.Cluster_MAGLEV},
+			expected: &envoy.Cluster{LbPolicy: envoy.Cluster_MAGLEV},
 		},
 		{
 			name: "ring_hash",
@ -897,7 +873,7 @@ func TestEnvoyLBConfig_InjectToCluster(t *testing.T) {
 					MaximumRingSize: 7,
 				},
 			},
-			expected: envoy.Cluster{
+			expected: &envoy.Cluster{
 				LbPolicy: envoy.Cluster_RING_HASH,
 				LbConfig: &envoy.Cluster_RingHashLbConfig_{
 					RingHashLbConfig: &envoy.Cluster_RingHashLbConfig{
@ -915,7 +891,7 @@ func TestEnvoyLBConfig_InjectToCluster(t *testing.T) {
 					ChoiceCount: 3,
 				},
 			},
-			expected: envoy.Cluster{
+			expected: &envoy.Cluster{
 				LbPolicy: envoy.Cluster_LEAST_REQUEST,
 				LbConfig: &envoy.Cluster_LeastRequestLbConfig_{
 					LeastRequestLbConfig: &envoy.Cluster_LeastRequestLbConfig{
@ -932,7 +908,7 @@ func TestEnvoyLBConfig_InjectToCluster(t *testing.T) {
 			err := injectLBToCluster(tc.lb, &c)
 			require.NoError(t, err)

-			require.Equal(t, tc.expected, c)
+			require.Equal(t, tc.expected, &c)
 		})
 	}
 }
--- a/agent/xds/config.go
+++ b/agent/xds/config.go
@ -5,11 +5,13 @@ import (
 	"time"

 	envoycluster "github.com/envoyproxy/go-control-plane/envoy/api/v2/cluster"
+
 	"github.com/golang/protobuf/ptypes"
 	"github.com/golang/protobuf/ptypes/wrappers"
+	"github.com/mitchellh/mapstructure"
+
 	"github.com/hashicorp/consul/agent/structs"
 	"github.com/hashicorp/consul/lib/decode"
-	"github.com/mitchellh/mapstructure"
 )

 // ProxyConfig describes the keys we understand from Connect.Proxy.Config. Note
--- a/agent/xds/config_test.go
+++ b/agent/xds/config_test.go
@ -4,8 +4,9 @@ import (
 	"testing"
 	"time"

-	"github.com/hashicorp/consul/agent/structs"
 	"github.com/stretchr/testify/require"
+
+	"github.com/hashicorp/consul/agent/structs"
 )

 func TestParseProxyConfig(t *testing.T) {
--- a/agent/xds/endpoints.go
+++ b/agent/xds/endpoints.go
@ -7,12 +7,14 @@ import (
 	envoy "github.com/envoyproxy/go-control-plane/envoy/api/v2"
 	envoycore "github.com/envoyproxy/go-control-plane/envoy/api/v2/core"
 	envoyendpoint "github.com/envoyproxy/go-control-plane/envoy/api/v2/endpoint"
+
 	"github.com/golang/protobuf/proto"
+	bexpr "github.com/hashicorp/go-bexpr"
+
 	"github.com/hashicorp/consul/agent/connect"
 	"github.com/hashicorp/consul/agent/proxycfg"
 	"github.com/hashicorp/consul/agent/structs"
 	"github.com/hashicorp/consul/api"
-	bexpr "github.com/hashicorp/go-bexpr"
 )

 const (
--- a/agent/xds/endpoints_test.go
+++ b/agent/xds/endpoints_test.go
@ -5,14 +5,13 @@ import (
 	"sort"
 	"testing"

-	"github.com/mitchellh/copystructure"
-
-	"github.com/stretchr/testify/require"
-
 	envoy "github.com/envoyproxy/go-control-plane/envoy/api/v2"
 	envoycore "github.com/envoyproxy/go-control-plane/envoy/api/v2/core"
 	envoyendpoint "github.com/envoyproxy/go-control-plane/envoy/api/v2/endpoint"
+
+	"github.com/mitchellh/copystructure"
 	testinf "github.com/mitchellh/go-testing-interface"
+	"github.com/stretchr/testify/require"

 	"github.com/hashicorp/consul/agent/proxycfg"
 	"github.com/hashicorp/consul/agent/structs"
@ -318,7 +317,6 @@ func Test_endpointsFromSnapshot(t *testing.T) {
 				snap.Proxy.Upstreams[0].Config["envoy_cluster_json"] =
 					customAppClusterJSON(t, customClusterJSONOptions{
 						Name: "myservice",
-						IncludeType: false,
 					})
 			},
 		},
--- a/agent/xds/envoy_versioning.go
+++ b/agent/xds/envoy_versioning.go
@ -2,24 +2,18 @@ package xds

 import (
 	"fmt"
-	"regexp"

 	envoycore "github.com/envoyproxy/go-control-plane/envoy/api/v2/core"
+
 	"github.com/hashicorp/go-version"
 )

 var (
 	// minSupportedVersion is the oldest mainline version we support. This should always be
 	// the zero'th point release of the last element of proxysupport.EnvoyVersions.
-	minSupportedVersion = version.Must(version.NewVersion("1.13.0"))
+	minSupportedVersion = version.Must(version.NewVersion("1.14.0"))

-	specificUnsupportedVersions = []unsupportedVersion{
-		{
-			Version:   version.Must(version.NewVersion("1.13.0")),
-			UpgradeTo: "1.13.1+",
-			Why:       "does not support RBAC rules using url_path",
-		},
-	}
+	specificUnsupportedVersions = []unsupportedVersion{}
 )

 type unsupportedVersion struct {
@ -68,28 +62,15 @@ func determineSupportedProxyFeaturesFromVersion(version *version.Version) (suppo
 	return supportedProxyFeatures{}, nil
 }

-// example: 1580db37e9a97c37e410bad0e1507ae1a0fd9e77/1.12.4/Clean/RELEASE/BoringSSL
-var buildVersionPattern = regexp.MustCompile(`^[a-f0-9]{40}/([^/]+)/Clean/RELEASE/BoringSSL$`)
-
 func determineEnvoyVersionFromNode(node *envoycore.Node) *version.Version {
 	if node == nil {
 		return nil
 	}

 	if node.UserAgentVersionType == nil {
-		if node.BuildVersion == "" {
 		return nil
 	}

-		// Must be an older pre-1.13 envoy
-		m := buildVersionPattern.FindStringSubmatch(node.BuildVersion)
-		if m == nil {
-			return nil
-		}
-
-		return version.Must(version.NewVersion(m[1]))
-	}
-
 	if node.UserAgentName != "envoy" {
 		return nil
 	}
--- a/agent/xds/envoy_versioning_test.go
+++ b/agent/xds/envoy_versioning_test.go
@ -5,9 +5,11 @@ import (

 	envoycore "github.com/envoyproxy/go-control-plane/envoy/api/v2/core"
 	envoytype "github.com/envoyproxy/go-control-plane/envoy/type"
-	"github.com/hashicorp/consul/sdk/testutil"
+
 	"github.com/hashicorp/go-version"
 	"github.com/stretchr/testify/require"
+
+	"github.com/hashicorp/consul/sdk/testutil"
 )

 func TestDetermineEnvoyVersionFromNode(t *testing.T) {
@ -19,12 +21,6 @@ func TestDetermineEnvoyVersionFromNode(t *testing.T) {
 			node:   &envoycore.Node{},
 			expect: nil,
 		},
-		"only build version": {
-			node: &envoycore.Node{
-				BuildVersion: "1580db37e9a97c37e410bad0e1507ae1a0fd9e77/1.9.0/Clean/RELEASE/BoringSSL",
-			},
-			expect: version.Must(version.NewVersion("1.9.0")),
-		},
 		"user agent build version but no user agent": {
 			node: &envoycore.Node{
 				UserAgentName: "",
@ -94,12 +90,18 @@ func TestDetermineSupportedProxyFeaturesFromString(t *testing.T) {
 		"1.12.5": {expectErr: "Envoy 1.12.5 " + errTooOld},
 		"1.12.6": {expectErr: "Envoy 1.12.6 " + errTooOld},
 		"1.12.7": {expectErr: "Envoy 1.12.7 " + errTooOld},
-		"1.13.0": {expectErr: "Envoy 1.13.0 " + err1_13},
+		"1.13.0": {expectErr: "Envoy 1.13.0 " + errTooOld},
+		"1.13.1": {expectErr: "Envoy 1.13.1 " + errTooOld},
+		"1.13.2": {expectErr: "Envoy 1.13.2 " + errTooOld},
+		"1.13.3": {expectErr: "Envoy 1.13.3 " + errTooOld},
+		"1.13.4": {expectErr: "Envoy 1.13.4 " + errTooOld},
+		"1.13.5": {expectErr: "Envoy 1.13.5 " + errTooOld},
+		"1.13.6": {expectErr: "Envoy 1.13.6 " + errTooOld},
+		"1.13.7": {expectErr: "Envoy 1.13.7 " + errTooOld},
 	}

 	// Insert a bunch of valid versions.
 	for _, v := range []string{
-		"1.13.1", "1.13.2", "1.13.3", "1.13.4", "1.13.6", "1.13.7",
 		"1.14.1", "1.14.2", "1.14.3", "1.14.4", "1.14.5", "1.14.6",
 		"1.15.0", "1.15.1", "1.15.2", "1.15.3",
 		"1.16.0", "1.16.1", "1.16.2",
--- a/agent/xds/failover_math.go
+++ b/agent/xds/failover_math.go
@ -2,6 +2,7 @@ package xds

 import (
 	envoycore "github.com/envoyproxy/go-control-plane/envoy/api/v2/core"
+
 	"github.com/hashicorp/consul/agent/structs"
 )

--- a/agent/xds/failover_math_test.go
+++ b/agent/xds/failover_math_test.go
@ -4,9 +4,10 @@ import (
 	"fmt"
 	"testing"

+	"github.com/stretchr/testify/require"
+
 	"github.com/hashicorp/consul/agent/proxycfg"
 	"github.com/hashicorp/consul/agent/structs"
-	"github.com/stretchr/testify/require"
 )

 func TestFirstHealthyTarget(t *testing.T) {
--- a/agent/xds/golden_test.go
+++ b/agent/xds/golden_test.go
@ -8,6 +8,7 @@ import (
 	"testing"

 	envoy "github.com/envoyproxy/go-control-plane/envoy/api/v2"
+
 	"github.com/golang/protobuf/jsonpb"
 	"github.com/golang/protobuf/proto"
 	"github.com/hashicorp/go-version"
--- a/agent/xds/listeners.go
+++ b/agent/xds/listeners.go
@ -1,7 +1,6 @@
 package xds

 import (
-	"encoding/json"
 	"errors"
 	"fmt"
 	"net"
@ -20,19 +19,18 @@ import (
 	envoyhttp "github.com/envoyproxy/go-control-plane/envoy/config/filter/network/http_connection_manager/v2"
 	envoytcp "github.com/envoyproxy/go-control-plane/envoy/config/filter/network/tcp_proxy/v2"
 	envoytype "github.com/envoyproxy/go-control-plane/envoy/type"
-	"github.com/envoyproxy/go-control-plane/pkg/conversion"
-	"github.com/envoyproxy/go-control-plane/pkg/wellknown"
+
 	"github.com/golang/protobuf/jsonpb"
 	"github.com/golang/protobuf/proto"
-	pbtypes "github.com/golang/protobuf/ptypes"
+	"github.com/golang/protobuf/ptypes"
 	"github.com/golang/protobuf/ptypes/any"
-	pbstruct "github.com/golang/protobuf/ptypes/struct"
 	"github.com/golang/protobuf/ptypes/wrappers"
+	"github.com/hashicorp/go-hclog"
+
 	"github.com/hashicorp/consul/agent/connect"
 	"github.com/hashicorp/consul/agent/proxycfg"
 	"github.com/hashicorp/consul/agent/structs"
 	"github.com/hashicorp/consul/logging"
-	"github.com/hashicorp/go-hclog"
 )

 // listenersFromSnapshot returns the xDS API representation of the "listeners" in the snapshot.
@ -319,7 +317,7 @@ func (s *Server) makeIngressGatewayListeners(address string, cfgSnap *proxycfg.C
 			resources = append(resources, upstreamListener)
 		} else {
 			// If multiple upstreams share this port, make a special listener for the protocol.
-			listener := makeListener(listenerKey.Protocol, address, listenerKey.Port)
+			listener := makeListener(listenerKey.Protocol, address, listenerKey.Port, envoycore.TrafficDirection_OUTBOUND)
 			opts := listenerFilterOpts{
 				useRDS:          true,
 				protocol:        listenerKey.Protocol,
@ -328,7 +326,6 @@ func (s *Server) makeIngressGatewayListeners(address string, cfgSnap *proxycfg.C
 				cluster:         "",
 				statPrefix:      "ingress_upstream.",
 				routePath:       "",
-				ingress:         false,
 				httpAuthzFilter: nil,
 			}
 			filter, err := makeListenerFilter(opts)
@ -336,12 +333,17 @@ func (s *Server) makeIngressGatewayListeners(address string, cfgSnap *proxycfg.C
 				return nil, err
 			}

+			transportSocket, err := makeDownstreamTLSTransportSocket(tlsContext)
+			if err != nil {
+				return nil, err
+			}
+
 			listener.FilterChains = []*envoylistener.FilterChain{
 				{
 					Filters: []*envoylistener.Filter{
 						filter,
 					},
-					TlsContext: tlsContext,
+					TransportSocket: transportSocket,
 				},
 			}
 			resources = append(resources, listener)
@ -362,10 +364,11 @@ func (s *Server) makeIngressGatewayListeners(address string, cfgSnap *proxycfg.C
 // changes them, we actually create a whole new listener on the new address and
 // port. Envoy should take care of closing the old one once it sees it's no
 // longer in the config.
-func makeListener(name, addr string, port int) *envoy.Listener {
+func makeListener(name, addr string, port int, trafficDirection envoycore.TrafficDirection) *envoy.Listener {
 	return &envoy.Listener{
 		Name:             fmt.Sprintf("%s:%s:%d", name, addr, port),
 		Address:          makeAddress(addr, port),
+		TrafficDirection: trafficDirection,
 	}
 }

@ -382,34 +385,16 @@ func makeListener(name, addr string, port int) *envoy.Listener {
 // any config generated by other systems will likely be in canonical protobuf
 // from rather than our slight variant in JSON/hcl.
 func makeListenerFromUserConfig(configJSON string) (*envoy.Listener, error) {
-	// Figure out if there is an @type field. We don't require is since we know
-	// this will be a listener but unmarshalling into any.Any fails if it's not
-	// there and unmarshalling into listener directly fails if it is...
-	var jsonFields map[string]*json.RawMessage
-	if err := json.Unmarshal([]byte(configJSON), &jsonFields); err != nil {
-		return nil, err
-	}
-
-	var l envoy.Listener
-
-	if _, ok := jsonFields["@type"]; ok {
 	// Type field is present so decode it as a any.Any
 	var any any.Any
-		err := jsonpb.UnmarshalString(configJSON, &any)
-		if err != nil {
+	if err := jsonpb.UnmarshalString(configJSON, &any); err != nil {
 		return nil, err
 	}
-		// And then unmarshal the listener again...
-		err = proto.Unmarshal(any.Value, &l)
-		if err != nil {
+	var l envoy.Listener
+	if err := proto.Unmarshal(any.Value, &l); err != nil {
 		return nil, err
 	}
-		return &l, err
-	}
-
-	// No @type so try decoding as a straight listener.
-	err := jsonpb.UnmarshalString(configJSON, &l)
-	return &l, err
+	return &l, nil
 }

 // Ensure that the first filter in each filter chain of a public listener is
@ -433,7 +418,10 @@ func (s *Server) injectConnectFilters(_ connectionInfo, cfgSnap *proxycfg.Config
 	return nil
 }

-const httpConnectionManagerNewName = "envoy.filters.network.http_connection_manager"
+const (
+	httpConnectionManagerOldName = "envoy.http_connection_manager"
+	httpConnectionManagerNewName = "envoy.filters.network.http_connection_manager"
+)

 // Locate the existing http connect manager L4 filter and inject our RBAC filter at the top.
 func (s *Server) injectHTTPFilterOnFilterChains(
@ -447,7 +435,7 @@ func (s *Server) injectHTTPFilterOnFilterChains(
 		)

 		for filterIdx, filter := range chain.Filters {
-			if filter.Name == wellknown.HTTPConnectionManager ||
+			if filter.Name == httpConnectionManagerOldName ||
 				filter.Name == httpConnectionManagerNewName {
 				hcmFilter = filter
 				hcmFilterIdx = filterIdx
@ -458,42 +446,35 @@ func (s *Server) injectHTTPFilterOnFilterChains(
 			return fmt.Errorf(
 				"filter chain %d lacks either a %q or %q filter",
 				chainIdx,
-				wellknown.HTTPConnectionManager,
+				httpConnectionManagerOldName,
 				httpConnectionManagerNewName,
 			)
 		}

 		var (
 			hcm envoyhttp.HttpConnectionManager
-			isTyped bool
 		)
-		switch x := hcmFilter.ConfigType.(type) {
-		case *envoylistener.Filter_Config:
-			if err := conversion.StructToMessage(x.Config, &hcm); err != nil {
-				return err
-			}
-			isTyped = false
-		case *envoylistener.Filter_TypedConfig:
-			if err := pbtypes.UnmarshalAny(x.TypedConfig, &hcm); err != nil {
-				return err
-			}
-			isTyped = true
-		default:
+		tc, ok := hcmFilter.ConfigType.(*envoylistener.Filter_TypedConfig)
+		if !ok {
 			return fmt.Errorf(
 				"filter chain %d has a %q filter with an unsupported config type: %T",
 				chainIdx,
 				hcmFilter.Name,
-				x,
+				hcmFilter.ConfigType,
 			)
 		}

+		if err := ptypes.UnmarshalAny(tc.TypedConfig, &hcm); err != nil {
+			return err
+		}
+
 		// Insert our authz filter before any others
 		hcm.HttpFilters = append([]*envoyhttp.HttpFilter{
 			authzFilter,
 		}, hcm.HttpFilters...)

 		// And persist the modified filter.
-		newFilter, err := makeFilter(hcmFilter.Name, &hcm, isTyped)
+		newFilter, err := makeFilter(hcmFilter.Name, &hcm)
 		if err != nil {
 			return err
 		}
@ -510,10 +491,15 @@ func (s *Server) injectHTTPFilterOnFilterChains(
 // coming up with some complicated templating/merging solution.
 func (s *Server) injectConnectTLSOnFilterChains(_ connectionInfo, cfgSnap *proxycfg.ConfigSnapshot, listener *envoy.Listener) error {
 	for idx := range listener.FilterChains {
-		listener.FilterChains[idx].TlsContext = &envoyauth.DownstreamTlsContext{
+		tlsContext := &envoyauth.DownstreamTlsContext{
 			CommonTlsContext:         makeCommonTLSContextFromLeaf(cfgSnap, cfgSnap.Leaf()),
 			RequireClientCertificate: &wrappers.BoolValue{Value: true},
 		}
+		transportSocket, err := makeDownstreamTLSTransportSocket(tlsContext)
+		if err != nil {
+			return err
+		}
+		listener.FilterChains[idx].TransportSocket = transportSocket
 	}
 	return nil
 }
@ -559,7 +545,7 @@ func (s *Server) makePublicListener(cInfo connectionInfo, cfgSnap *proxycfg.Conf
 			port = cfg.BindPort
 		}

-		l = makeListener(PublicListenerName, addr, port)
+		l = makeListener(PublicListenerName, addr, port, envoycore.TrafficDirection_INBOUND)

 		opts := listenerFilterOpts{
 			useRDS:           false,
@ -569,7 +555,6 @@ func (s *Server) makePublicListener(cInfo connectionInfo, cfgSnap *proxycfg.Conf
 			cluster:          LocalAppClusterName,
 			statPrefix:       "",
 			routePath:        "",
-			ingress:          true,
 			requestTimeoutMs: cfg.LocalRequestTimeoutMs,
 		}

@ -653,7 +638,7 @@ func (s *Server) makeExposedCheckListener(cfgSnap *proxycfg.ConfigSnapshot, clus
 	strippedPath := r.ReplaceAllString(path.Path, "")
 	listenerName := fmt.Sprintf("exposed_path_%s", strippedPath)

-	l := makeListener(listenerName, addr, path.ListenerPort)
+	l := makeListener(listenerName, addr, path.ListenerPort, envoycore.TrafficDirection_INBOUND)

 	filterName := fmt.Sprintf("exposed_path_filter_%s_%d", strippedPath, path.ListenerPort)

@ -665,7 +650,6 @@ func (s *Server) makeExposedCheckListener(cfgSnap *proxycfg.ConfigSnapshot, clus
 		cluster:         cluster,
 		statPrefix:      "",
 		routePath:       path.Path,
-		ingress:         true,
 		httpAuthzFilter: nil,
 	}
 	f, err := makeListenerFilter(opts)
@ -720,7 +704,7 @@ func (s *Server) makeTerminatingGatewayListener(
 	name, addr string,
 	port int,
 ) (*envoy.Listener, error) {
-	l := makeListener(name, addr, port)
+	l := makeListener(name, addr, port, envoycore.TrafficDirection_INBOUND)

 	tlsInspector, err := makeTLSInspectorListenerFilter()
 	if err != nil {
@ -822,13 +806,19 @@ func (s *Server) makeFilterChainTerminatingGateway(
 	intentions structs.Intentions,
 	protocol string,
 ) (*envoylistener.FilterChain, error) {
+	tlsContext := &envoyauth.DownstreamTlsContext{
+		CommonTlsContext:         makeCommonTLSContextFromLeaf(cfgSnap, cfgSnap.TerminatingGateway.ServiceLeaves[service]),
+		RequireClientCertificate: &wrappers.BoolValue{Value: true},
+	}
+	transportSocket, err := makeDownstreamTLSTransportSocket(tlsContext)
+	if err != nil {
+		return nil, err
+	}
+
 	filterChain := &envoylistener.FilterChain{
 		FilterChainMatch: makeSNIFilterChainMatch(cluster),
 		Filters:          make([]*envoylistener.Filter, 0, 3),
-		TlsContext: &envoyauth.DownstreamTlsContext{
-			CommonTlsContext:         makeCommonTLSContextFromLeaf(cfgSnap, cfgSnap.TerminatingGateway.ServiceLeaves[service]),
-			RequireClientCertificate: &wrappers.BoolValue{Value: true},
-		},
+		TransportSocket:  transportSocket,
 	}

 	// This controls if we do L4 or L7 intention checks.
@ -857,7 +847,6 @@ func (s *Server) makeFilterChainTerminatingGateway(
 		cluster:    cluster,
 		statPrefix: statPrefix,
 		routePath:  "",
-		ingress:    false,
 	}

 	if useHTTPFilter {
@ -908,7 +897,7 @@ func (s *Server) makeMeshGatewayListener(name, addr string, port int, cfgSnap *p
 		},
 	}

-	l := makeListener(name, addr, port)
+	l := makeListener(name, addr, port, envoycore.TrafficDirection_UNSPECIFIED)
 	l.ListenerFilters = []*envoylistener.ListenerFilter{tlsInspector}

 	// TODO (mesh-gateway) - Do we need to create clusters for all the old trust domains as well?
@ -996,7 +985,7 @@ func (s *Server) makeUpstreamListenerForDiscoveryChain(
 		address = "127.0.0.1"
 	}
 	upstreamID := u.Identifier()
-	l := makeListener(upstreamID, address, u.LocalBindPort)
+	l := makeListener(upstreamID, address, u.LocalBindPort, envoycore.TrafficDirection_OUTBOUND)

 	cfg := getAndModifyUpstreamConfigForListener(s.Logger, u, chain)
 	if cfg.ListenerJSON != "" {
@ -1060,7 +1049,6 @@ func (s *Server) makeUpstreamListenerForDiscoveryChain(
 		cluster:         clusterName,
 		statPrefix:      "upstream.",
 		routePath:       "",
-		ingress:         false,
 		httpAuthzFilter: nil,
 	}
 	filter, err := makeListenerFilter(opts)
@ -1068,12 +1056,17 @@ func (s *Server) makeUpstreamListenerForDiscoveryChain(
 		return nil, err
 	}

+	transportSocket, err := makeDownstreamTLSTransportSocket(tlsContext)
+	if err != nil {
+		return nil, err
+	}
+
 	l.FilterChains = []*envoylistener.FilterChain{
 		{
 			Filters: []*envoylistener.Filter{
 				filter,
 			},
-			TlsContext: tlsContext,
+			TransportSocket: transportSocket,
 		},
 	}
 	return l, nil
@ -1134,7 +1127,6 @@ type listenerFilterOpts struct {
 	cluster          string
 	statPrefix       string
 	routePath        string
-	ingress          bool
 	requestTimeoutMs *int
 	httpAuthzFilter  *envoyhttp.HttpFilter
 }
@ -1156,7 +1148,7 @@ func makeListenerFilter(opts listenerFilterOpts) (*envoylistener.Filter, error)
 }

 func makeTLSInspectorListenerFilter() (*envoylistener.ListenerFilter, error) {
-	return &envoylistener.ListenerFilter{Name: wellknown.TlsInspector}, nil
+	return &envoylistener.ListenerFilter{Name: "envoy.filters.listener.tls_inspector"}, nil
 }

 func makeSNIFilterChainMatch(sniMatch string) *envoylistener.FilterChainMatch {
@ -1175,7 +1167,7 @@ func makeTCPProxyFilter(filterName, cluster, statPrefix string) (*envoylistener.
 		StatPrefix:       makeStatPrefix(statPrefix, filterName),
 		ClusterSpecifier: &envoytcp.TcpProxy_Cluster{Cluster: cluster},
 	}
-	return makeFilter("envoy.tcp_proxy", cfg, false)
+	return makeFilter("envoy.filters.network.tcp_proxy", cfg)
 }

 func makeStatPrefix(prefix, filterName string) string {
@ -1186,21 +1178,15 @@ func makeStatPrefix(prefix, filterName string) string {
 }

 func makeHTTPFilter(opts listenerFilterOpts) (*envoylistener.Filter, error) {
-	op := envoyhttp.HttpConnectionManager_Tracing_INGRESS
-	if !opts.ingress {
-		op = envoyhttp.HttpConnectionManager_Tracing_EGRESS
-	}
-
 	cfg := &envoyhttp.HttpConnectionManager{
 		StatPrefix: makeStatPrefix(opts.statPrefix, opts.filterName),
 		CodecType:  envoyhttp.HttpConnectionManager_AUTO,
 		HttpFilters: []*envoyhttp.HttpFilter{
 			{
-				Name: "envoy.router",
+				Name: "envoy.filters.http.router",
 			},
 		},
 		Tracing: &envoyhttp.HttpConnectionManager_Tracing{
-			OperationName: op,
 			// Don't trace any requests by default unless the client application
 			// explicitly propagates trace headers that indicate this should be
 			// sampled.
@ -1249,7 +1235,7 @@ func makeHTTPFilter(opts listenerFilterOpts) (*envoylistener.Filter, error) {

 		if opts.requestTimeoutMs != nil {
 			r := route.GetRoute()
-			r.Timeout = pbtypes.DurationProto(time.Duration(*opts.requestTimeoutMs) * time.Millisecond)
+			r.Timeout = ptypes.DurationProto(time.Duration(*opts.requestTimeoutMs) * time.Millisecond)
 		}

 		// If a path is provided, do not match on a catch-all prefix
@ -1289,49 +1275,35 @@ func makeHTTPFilter(opts listenerFilterOpts) (*envoylistener.Filter, error) {
 		// Add grpc bridge before router and authz
 		cfg.HttpFilters = append([]*envoyhttp.HttpFilter{{
 			Name: "envoy.grpc_http1_bridge",
-			ConfigType: &envoyhttp.HttpFilter_Config{Config: &pbstruct.Struct{}},
 		}}, cfg.HttpFilters...)
 	}

-	return makeFilter("envoy.http_connection_manager", cfg, false)
+	return makeFilter("envoy.filters.network.http_connection_manager", cfg)
 }

-func makeFilter(name string, cfg proto.Message, typed bool) (*envoylistener.Filter, error) {
+func makeFilter(name string, cfg proto.Message) (*envoylistener.Filter, error) {
 	filter := &envoylistener.Filter{
 		Name: name,
 	}
-	if typed {
-		any, err := pbtypes.MarshalAny(cfg)
+	any, err := ptypes.MarshalAny(cfg)
 	if err != nil {
 		return nil, err
 	}

 	filter.ConfigType = &envoylistener.Filter_TypedConfig{TypedConfig: any}
-	} else {
-		// Ridiculous dance to make that struct into pbstruct.Struct by... encoding it
-		// as JSON and decoding again!!
-		cfgStruct, err := conversion.MessageToStruct(cfg)
-		if err != nil {
-			return nil, err
-		}
-
-		filter.ConfigType = &envoylistener.Filter_Config{Config: cfgStruct}
-	}

 	return filter, nil
 }

 func makeEnvoyHTTPFilter(name string, cfg proto.Message) (*envoyhttp.HttpFilter, error) {
-	// Ridiculous dance to make that struct into pbstruct.Struct by... encoding it
-	// as JSON and decoding again!!
-	cfgStruct, err := conversion.MessageToStruct(cfg)
+	any, err := ptypes.MarshalAny(cfg)
 	if err != nil {
 		return nil, err
 	}

 	return &envoyhttp.HttpFilter{
 		Name:       name,
-		ConfigType: &envoyhttp.HttpFilter_Config{Config: cfgStruct},
+		ConfigType: &envoyhttp.HttpFilter_TypedConfig{TypedConfig: any},
 	}, nil
 }

@ -1376,6 +1348,34 @@ func makeCommonTLSContextFromLeaf(cfgSnap *proxycfg.ConfigSnapshot, leaf *struct
 	}
 }

+func makeDownstreamTLSTransportSocket(tlsContext *envoyauth.DownstreamTlsContext) (*envoycore.TransportSocket, error) {
+	if tlsContext == nil {
+		return nil, nil
+	}
+	return makeTransportSocket("tls", tlsContext)
+}
+
+func makeUpstreamTLSTransportSocket(tlsContext *envoyauth.UpstreamTlsContext) (*envoycore.TransportSocket, error) {
+	if tlsContext == nil {
+		return nil, nil
+	}
+
+	return makeTransportSocket("tls", tlsContext)
+}
+
+func makeTransportSocket(name string, config proto.Message) (*envoycore.TransportSocket, error) {
+	any, err := ptypes.MarshalAny(config)
+	if err != nil {
+		return nil, err
+	}
+	return &envoycore.TransportSocket{
+		Name: name,
+		ConfigType: &envoycore.TransportSocket_TypedConfig{
+			TypedConfig: any,
+		},
+	}, nil
+}
+
 func makeCommonTLSContextFromFiles(caFile, certFile, keyFile string) *envoyauth.CommonTlsContext {
 	ctx := envoyauth.CommonTlsContext{
 		TlsParams: &envoyauth.TlsParameters{},
--- a/agent/xds/listeners_test.go
+++ b/agent/xds/listeners_test.go
@ -9,7 +9,7 @@ import (
 	"time"

 	envoy "github.com/envoyproxy/go-control-plane/envoy/api/v2"
-	"github.com/envoyproxy/go-control-plane/pkg/wellknown"
+
 	testinf "github.com/mitchellh/go-testing-interface"
 	"github.com/stretchr/testify/require"

@ -92,7 +92,6 @@ func TestListenersFromSnapshot(t *testing.T) {
 				snap.Proxy.Config["envoy_public_listener_json"] =
 					customListenerJSON(t, customListenerJSONOptions{
 						Name: "custom-public-listen",
-						IncludeType: false,
 					})
 			},
 		},
@ -107,18 +106,6 @@ func TestListenersFromSnapshot(t *testing.T) {
 					})
 			},
 		},
-		{
-			name:   "custom-public-listener-http-typed",
-			create: proxycfg.TestConfigSnapshot,
-			setup: func(snap *proxycfg.ConfigSnapshot) {
-				snap.Proxy.Config["protocol"] = "http"
-				snap.Proxy.Config["envoy_public_listener_json"] =
-					customHTTPListenerJSON(t, customHTTPListenerJSONOptions{
-						Name:        "custom-public-listen",
-						TypedConfig: true,
-					})
-			},
-		},
 		{
 			name:   "custom-public-listener-http-2",
 			create: proxycfg.TestConfigSnapshot,
@ -131,19 +118,6 @@ func TestListenersFromSnapshot(t *testing.T) {
 					})
 			},
 		},
-		{
-			name:   "custom-public-listener-http-2-typed",
-			create: proxycfg.TestConfigSnapshot,
-			setup: func(snap *proxycfg.ConfigSnapshot) {
-				snap.Proxy.Config["protocol"] = "http"
-				snap.Proxy.Config["envoy_public_listener_json"] =
-					customHTTPListenerJSON(t, customHTTPListenerJSONOptions{
-						Name:                      "custom-public-listen",
-						HTTPConnectionManagerName: httpConnectionManagerNewName,
-						TypedConfig:               true,
-					})
-			},
-		},
 		{
 			name:   "custom-public-listener-http-missing",
 			create: proxycfg.TestConfigSnapshot,
@ -152,19 +126,6 @@ func TestListenersFromSnapshot(t *testing.T) {
 				snap.Proxy.Config["envoy_public_listener_json"] =
 					customListenerJSON(t, customListenerJSONOptions{
 						Name: "custom-public-listen",
-						IncludeType: false,
-					})
-			},
-		},
-		{
-			name:               "custom-public-listener-typed",
-			create:             proxycfg.TestConfigSnapshot,
-			overrideGoldenName: "custom-public-listener", // should be the same
-			setup: func(snap *proxycfg.ConfigSnapshot) {
-				snap.Proxy.Config["envoy_public_listener_json"] =
-					customListenerJSON(t, customListenerJSONOptions{
-						Name:        "custom-public-listen",
-						IncludeType: true,
 					})
 			},
 		},
@ -176,9 +137,8 @@ func TestListenersFromSnapshot(t *testing.T) {
 				snap.Proxy.Config["envoy_public_listener_json"] =
 					customListenerJSON(t, customListenerJSONOptions{
 						Name: "custom-public-listen",
-						IncludeType: true,
 						// Attempt to override the TLS context should be ignored
-						TLSContext: `{"requireClientCertificate": false}`,
+						TLSContext: `"allowRenegotiation": false`,
 					})
 			},
 		},
@ -189,30 +149,16 @@ func TestListenersFromSnapshot(t *testing.T) {
 				snap.Proxy.Upstreams[0].Config["envoy_listener_json"] =
 					customListenerJSON(t, customListenerJSONOptions{
 						Name: "custom-upstream",
-						IncludeType: false,
 					})
 			},
 		},
 		{
-			name:               "custom-upstream-typed",
-			create:             proxycfg.TestConfigSnapshot,
-			overrideGoldenName: "custom-upstream", // should be the same
-			setup: func(snap *proxycfg.ConfigSnapshot) {
-				snap.Proxy.Upstreams[0].Config["envoy_listener_json"] =
-					customListenerJSON(t, customListenerJSONOptions{
-						Name:        "custom-upstream",
-						IncludeType: true,
-					})
-			},
-		},
-		{
-			name:   "custom-upstream-typed-ignored-with-disco-chain",
+			name:   "custom-upstream-ignored-with-disco-chain",
 			create: proxycfg.TestConfigSnapshotDiscoveryChainWithFailover,
 			setup: func(snap *proxycfg.ConfigSnapshot) {
 				snap.Proxy.Upstreams[0].Config["envoy_listener_json"] =
 					customListenerJSON(t, customListenerJSONOptions{
 						Name: "custom-upstream",
-						IncludeType: true,
 					})
 			},
 		},
@ -588,7 +534,7 @@ func TestListenersFromSnapshot(t *testing.T) {
 	}
 }

-func expectListenerJSONResources(t *testing.T, snap *proxycfg.ConfigSnapshot) map[string]string {
+func expectListenerJSONResources(snap *proxycfg.ConfigSnapshot) map[string]string {
 	return map[string]string{
 		"public_listener": `{
 				"@type": "type.googleapis.com/envoy.api.v2.Listener",
@ -599,23 +545,26 @@ func expectListenerJSONResources(t *testing.T, snap *proxycfg.ConfigSnapshot) ma
 						"portValue": 9999
 					}
 				},
+				"trafficDirection": "INBOUND",
 				"filterChains": [
 					{
-						"tlsContext": ` + expectedPublicTLSContextJSON(t, snap) + `,
+						"transportSocket": ` + expectedPublicTransportSocketJSON(snap) + `,
 						"filters": [
 							{
 								"name": "envoy.filters.network.rbac",
-								"config": {
+								"typedConfig": {
+									"@type": "type.googleapis.com/envoy.config.filter.network.rbac.v2.RBAC",
 										"rules": {
 											},
-										"stat_prefix": "connect_authz"
+										"statPrefix": "connect_authz"
 									}
 							},
 							{
-								"name": "envoy.tcp_proxy",
-								"config": {
+								"name": "envoy.filters.network.tcp_proxy",
+								"typedConfig": {
+									"@type": "type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy",
 									"cluster": "local_app",
-									"stat_prefix": "public_listener"
+									"statPrefix": "public_listener"
 								}
 							}
 						]
@ -631,14 +580,16 @@ func expectListenerJSONResources(t *testing.T, snap *proxycfg.ConfigSnapshot) ma
 					"portValue": 9191
 				}
 			},
+			"trafficDirection": "OUTBOUND",
 			"filterChains": [
 				{
 					"filters": [
 						{
-							"name": "envoy.tcp_proxy",
-							"config": {
+							"name": "envoy.filters.network.tcp_proxy",
+							"typedConfig": {
+								"@type": "type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy",
 								"cluster": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-								"stat_prefix": "upstream.db.default.dc1"
+								"statPrefix": "upstream.db.default.dc1"
 							}
 						}
 					]
@ -654,14 +605,16 @@ func expectListenerJSONResources(t *testing.T, snap *proxycfg.ConfigSnapshot) ma
 					"portValue": 8181
 				}
 			},
+			"trafficDirection": "OUTBOUND",
 			"filterChains": [
 				{
 					"filters": [
 						{
-							"name": "envoy.tcp_proxy",
-							"config": {
+							"name": "envoy.filters.network.tcp_proxy",
+							"typedConfig": {
+								"@type": "type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy",
 								"cluster": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul",
-								"stat_prefix": "upstream.prepared_query_geo-cache"
+								"statPrefix": "upstream.prepared_query_geo-cache"
 							}
 						}
 					]
@ -697,20 +650,17 @@ func expectListenerJSONFromResources(snap *proxycfg.ConfigSnapshot, v, n uint64,
 		}`
 }

-func expectListenerJSON(t *testing.T, snap *proxycfg.ConfigSnapshot, v, n uint64) string {
-	return expectListenerJSONFromResources(snap, v, n, expectListenerJSONResources(t, snap))
+func expectListenerJSON(snap *proxycfg.ConfigSnapshot, v, n uint64) string {
+	return expectListenerJSONFromResources(snap, v, n, expectListenerJSONResources(snap))
 }

 type customListenerJSONOptions struct {
 	Name       string
-	IncludeType bool
 	TLSContext string
 }

 const customListenerJSONTpl = `{
-	{{ if .IncludeType -}}
 	"@type": "type.googleapis.com/envoy.api.v2.Listener",
-	{{- end }}
 	"name": "{{ .Name }}",
 	"address": {
 		"socketAddress": {
@ -721,14 +671,21 @@ const customListenerJSONTpl = `{
 	"filterChains": [
 		{
 			{{ if .TLSContext -}}
-			"tlsContext": {{ .TLSContext }},
+			"transport_socket": {
+				"name": "tls",
+				"typed_config": {
+					"@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
+					{{ .TLSContext }}
+				}
+			},
 			{{- end }}
 			"filters": [
 				{
-					"name": "envoy.tcp_proxy",
-					"config": {
+					"name": "envoy.filters.network.tcp_proxy",
+					"typedConfig": {
+						"@type": "type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy",
 							"cluster": "random-cluster",
-							"stat_prefix": "foo-stats"
+							"statPrefix": "foo-stats"
 						}
 				}
 			]
@ -739,10 +696,10 @@ const customListenerJSONTpl = `{
 type customHTTPListenerJSONOptions struct {
 	Name                      string
 	HTTPConnectionManagerName string
-	TypedConfig               bool
 }

 const customHTTPListenerJSONTpl = `{
+	"@type": "type.googleapis.com/envoy.api.v2.Listener",
 	"name": "{{ .Name }}",
 	"address": {
 		"socketAddress": {
@ -755,15 +712,11 @@ const customHTTPListenerJSONTpl = `{
 			"filters": [
 				{
 					"name": "{{ .HTTPConnectionManagerName }}",
-					{{ if .TypedConfig -}}
 					"typedConfig": {
 					"@type": "type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager",
-					{{ else -}}
-					"config": {
-					{{- end }}
 						"http_filters": [
 							{
-								"name": "envoy.router"
+								"name": "envoy.filters.http.router"
 							}
 						],
 						"route_config": {
@ -809,7 +762,7 @@ func customListenerJSON(t *testing.T, opts customListenerJSONOptions) string {
 func customHTTPListenerJSON(t *testing.T, opts customHTTPListenerJSONOptions) string {
 	t.Helper()
 	if opts.HTTPConnectionManagerName == "" {
-		opts.HTTPConnectionManagerName = wellknown.HTTPConnectionManager
+		opts.HTTPConnectionManagerName = httpConnectionManagerNewName
 	}
 	var buf bytes.Buffer
 	require.NoError(t, customHTTPListenerJSONTemplate.Execute(&buf, opts))
--- a/agent/xds/proxysupport/proxysupport.go
+++ b/agent/xds/proxysupport/proxysupport.go
@ -7,8 +7,8 @@ package proxysupport
 //
 // see: https://www.consul.io/docs/connect/proxies/envoy#supported-versions
 var EnvoyVersions = []string{
+	// TODO(rb): add in 1.17.0 when the v3 support comes
 	"1.16.2",
 	"1.15.3",
 	"1.14.6",
-	"1.13.7",
 }
--- a/agent/xds/rbac.go
+++ b/agent/xds/rbac.go
@ -12,6 +12,7 @@ import (
 	envoynetrbac "github.com/envoyproxy/go-control-plane/envoy/config/filter/network/rbac/v2"
 	envoyrbac "github.com/envoyproxy/go-control-plane/envoy/config/rbac/v2"
 	envoymatcher "github.com/envoyproxy/go-control-plane/envoy/type/matcher"
+
 	"github.com/hashicorp/consul/agent/structs"
 )

@ -25,7 +26,7 @@ func makeRBACNetworkFilter(intentions structs.Intentions, intentionDefaultAllow
 		StatPrefix: "connect_authz",
 		Rules:      rules,
 	}
-	return makeFilter("envoy.filters.network.rbac", cfg, false)
+	return makeFilter("envoy.filters.network.rbac", cfg)
 }

 func makeRBACHTTPFilter(intentions structs.Intentions, intentionDefaultAllow bool) (*envoyhttp.HttpFilter, error) {
--- a/agent/xds/rbac_test.go
+++ b/agent/xds/rbac_test.go
@ -6,9 +6,10 @@ import (
 	"sort"
 	"testing"

-	"github.com/hashicorp/consul/agent/structs"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	"github.com/hashicorp/consul/agent/structs"
 )

 func TestMakeRBACNetworkAndHTTPFilters(t *testing.T) {
--- a/agent/xds/response.go
+++ b/agent/xds/response.go
@ -4,6 +4,7 @@ import (
 	envoy "github.com/envoyproxy/go-control-plane/envoy/api/v2"
 	envoycore "github.com/envoyproxy/go-control-plane/envoy/api/v2/core"
 	envoymatcher "github.com/envoyproxy/go-control-plane/envoy/type/matcher"
+
 	"github.com/golang/protobuf/proto"
 	"github.com/golang/protobuf/ptypes/any"
 	"github.com/golang/protobuf/ptypes/wrappers"
--- a/agent/xds/routes.go
+++ b/agent/xds/routes.go
@ -10,8 +10,10 @@ import (
 	envoy "github.com/envoyproxy/go-control-plane/envoy/api/v2"
 	envoyroute "github.com/envoyproxy/go-control-plane/envoy/api/v2/route"
 	envoymatcher "github.com/envoyproxy/go-control-plane/envoy/type/matcher"
+
 	"github.com/golang/protobuf/proto"
 	"github.com/golang/protobuf/ptypes"
+
 	"github.com/hashicorp/consul/agent/connect"
 	"github.com/hashicorp/consul/agent/proxycfg"
 	"github.com/hashicorp/consul/agent/structs"
--- a/agent/xds/routes_test.go
+++ b/agent/xds/routes_test.go
@ -8,6 +8,7 @@ import (

 	envoy "github.com/envoyproxy/go-control-plane/envoy/api/v2"
 	envoyroute "github.com/envoyproxy/go-control-plane/envoy/api/v2/route"
+
 	"github.com/golang/protobuf/ptypes"
 	testinf "github.com/mitchellh/go-testing-interface"
 	"github.com/stretchr/testify/require"
@ -288,7 +289,7 @@ func TestEnvoyLBConfig_InjectToRouteAction(t *testing.T) {
 	var tests = []struct {
 		name     string
 		lb       *structs.LoadBalancer
-		expected envoyroute.RouteAction
+		expected *envoyroute.RouteAction
 	}{
 		{
 			name: "empty",
@ -296,7 +297,7 @@ func TestEnvoyLBConfig_InjectToRouteAction(t *testing.T) {
 				Policy: "",
 			},
 			// we only modify route actions for hash-based LB policies
-			expected: envoyroute.RouteAction{},
+			expected: &envoyroute.RouteAction{},
 		},
 		{
 			name: "least request",
@ -307,7 +308,7 @@ func TestEnvoyLBConfig_InjectToRouteAction(t *testing.T) {
 				},
 			},
 			// we only modify route actions for hash-based LB policies
-			expected: envoyroute.RouteAction{},
+			expected: &envoyroute.RouteAction{},
 		},
 		{
 			name: "headers",
@ -325,7 +326,7 @@ func TestEnvoyLBConfig_InjectToRouteAction(t *testing.T) {
 					},
 				},
 			},
-			expected: envoyroute.RouteAction{
+			expected: &envoyroute.RouteAction{
 				HashPolicy: []*envoyroute.RouteAction_HashPolicy{
 					{
 						PolicySpecifier: &envoyroute.RouteAction_HashPolicy_Header_{
@ -354,7 +355,7 @@ func TestEnvoyLBConfig_InjectToRouteAction(t *testing.T) {
 					},
 				},
 			},
-			expected: envoyroute.RouteAction{
+			expected: &envoyroute.RouteAction{
 				HashPolicy: []*envoyroute.RouteAction_HashPolicy{
 					{
 						PolicySpecifier: &envoyroute.RouteAction_HashPolicy_Cookie_{
@ -389,7 +390,7 @@ func TestEnvoyLBConfig_InjectToRouteAction(t *testing.T) {
 					},
 				},
 			},
-			expected: envoyroute.RouteAction{
+			expected: &envoyroute.RouteAction{
 				HashPolicy: []*envoyroute.RouteAction_HashPolicy{
 					{
 						PolicySpecifier: &envoyroute.RouteAction_HashPolicy_Cookie_{
@ -416,7 +417,7 @@ func TestEnvoyLBConfig_InjectToRouteAction(t *testing.T) {
 					},
 				},
 			},
-			expected: envoyroute.RouteAction{
+			expected: &envoyroute.RouteAction{
 				HashPolicy: []*envoyroute.RouteAction_HashPolicy{
 					{
 						PolicySpecifier: &envoyroute.RouteAction_HashPolicy_Cookie_{
@ -441,7 +442,7 @@ func TestEnvoyLBConfig_InjectToRouteAction(t *testing.T) {
 					},
 				},
 			},
-			expected: envoyroute.RouteAction{
+			expected: &envoyroute.RouteAction{
 				HashPolicy: []*envoyroute.RouteAction_HashPolicy{
 					{
 						PolicySpecifier: &envoyroute.RouteAction_HashPolicy_ConnectionProperties_{
@ -486,7 +487,7 @@ func TestEnvoyLBConfig_InjectToRouteAction(t *testing.T) {
 					},
 				},
 			},
-			expected: envoyroute.RouteAction{
+			expected: &envoyroute.RouteAction{
 				HashPolicy: []*envoyroute.RouteAction_HashPolicy{
 					{
 						PolicySpecifier: &envoyroute.RouteAction_HashPolicy_ConnectionProperties_{
@ -533,7 +534,7 @@ func TestEnvoyLBConfig_InjectToRouteAction(t *testing.T) {
 			err := injectLBToRouteAction(tc.lb, &ra)
 			require.NoError(t, err)

-			require.Equal(t, &tc.expected, &ra)
+			require.Equal(t, tc.expected, &ra)
 		})
 	}
 }
--- a/agent/xds/server.go
+++ b/agent/xds/server.go
@ -11,6 +11,7 @@ import (
 	envoy "github.com/envoyproxy/go-control-plane/envoy/api/v2"
 	envoycore "github.com/envoyproxy/go-control-plane/envoy/api/v2/core"
 	envoydisco "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v2"
+
 	"github.com/golang/protobuf/proto"
 	"github.com/hashicorp/go-hclog"
 	"google.golang.org/grpc"
--- a/agent/xds/server_oss.go
+++ b/agent/xds/server_oss.go
@ -4,6 +4,7 @@ package xds

 import (
 	envoycore "github.com/envoyproxy/go-control-plane/envoy/api/v2/core"
+
 	"github.com/hashicorp/consul/agent/structs"
 )

--- a/agent/xds/server_test.go
+++ b/agent/xds/server_test.go
@ -8,6 +8,7 @@ import (
 	"time"

 	envoy "github.com/envoyproxy/go-control-plane/envoy/api/v2"
+
 	"github.com/stretchr/testify/require"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
@ -148,7 +149,7 @@ func TestServer_StreamAggregatedResources_BasicProtocol(t *testing.T) {
 	envoy.SendReq(t, EndpointType, 1, 2)

 	// And should get a response immediately.
-	assertResponseSent(t, envoy.stream.sendCh, expectListenerJSON(t, snap, 1, 3))
+	assertResponseSent(t, envoy.stream.sendCh, expectListenerJSON(snap, 1, 3))

 	// Now send Route request along with next listener one
 	envoy.SendReq(t, RouteType, 0, 0)
@ -175,7 +176,7 @@ func TestServer_StreamAggregatedResources_BasicProtocol(t *testing.T) {
 	// which is reasonable anyway to ensure consistency of the config Envoy sees.
 	assertResponseSent(t, envoy.stream.sendCh, expectClustersJSON(snap, 2, 4))
 	assertResponseSent(t, envoy.stream.sendCh, expectEndpointsJSON(2, 5))
-	assertResponseSent(t, envoy.stream.sendCh, expectListenerJSON(t, snap, 2, 6))
+	assertResponseSent(t, envoy.stream.sendCh, expectListenerJSON(snap, 2, 6))

 	// Let's pretend that Envoy doesn't like that new listener config. It will ACK
 	// all the others (same version) but NACK the listener. This is the most
@ -212,7 +213,7 @@ func TestServer_StreamAggregatedResources_BasicProtocol(t *testing.T) {

 	assertResponseSent(t, envoy.stream.sendCh, expectClustersJSON(snap, 3, 7))
 	assertResponseSent(t, envoy.stream.sendCh, expectEndpointsJSON(3, 8))
-	assertResponseSent(t, envoy.stream.sendCh, expectListenerJSON(t, snap, 3, 9))
+	assertResponseSent(t, envoy.stream.sendCh, expectListenerJSON(snap, 3, 9))
 }

 func expectEndpointsJSON(v, n uint64) string {
@ -293,15 +294,20 @@ func expectEndpointsJSON(v, n uint64) string {
 	}`
 }

-func expectedUpstreamTLSContextJSON(snap *proxycfg.ConfigSnapshot, sni string) string {
-	return expectedTLSContextJSON(snap, false, sni)
+func expectedUpstreamTransportSocketJSON(snap *proxycfg.ConfigSnapshot, sni string) string {
+	return expectedTransportSocketJSON(snap, "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext", false, sni)
 }

-func expectedPublicTLSContextJSON(t *testing.T, snap *proxycfg.ConfigSnapshot) string {
-	return expectedTLSContextJSON(snap, true, "")
+func expectedPublicTransportSocketJSON(snap *proxycfg.ConfigSnapshot) string {
+	return expectedTransportSocketJSON(snap, "type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext", true, "")
 }

-func expectedTLSContextJSON(snap *proxycfg.ConfigSnapshot, requireClientCert bool, sni string) string {
+func expectedTransportSocketJSON(
+	snap *proxycfg.ConfigSnapshot,
+	extType string,
+	requireClientCert bool,
+	sni string,
+) string {
 	// Assume just one root for now, can get fancier later if needed.
 	caPEM := snap.Roots.Roots[0].RootCert
 	reqClient := ""
@ -317,6 +323,9 @@ func expectedTLSContextJSON(snap *proxycfg.ConfigSnapshot, requireClientCert boo
 	}

 	return `{
+	"name": "tls",
+	"typedConfig": {
+		"@type": "` + extType + `",
 		"commonTlsContext": {
 			"tlsParams": {},
 			"tlsCertificates": [
@ -337,6 +346,7 @@ func expectedTLSContextJSON(snap *proxycfg.ConfigSnapshot, requireClientCert boo
 		}
 		` + reqClient + `
 		` + upstreamSNI + `
+ 		}
 	}`
 }

@ -476,7 +486,7 @@ func TestServer_StreamAggregatedResources_ACLEnforcement(t *testing.T) {
 			envoy.SendReq(t, ListenerType, 0, 0)

 			if !tt.wantDenied {
-				assertResponseSent(t, envoy.stream.sendCh, expectListenerJSON(t, snap, 1, 1))
+				assertResponseSent(t, envoy.stream.sendCh, expectListenerJSON(snap, 1, 1))
 				// Close the client stream since all is well. We _don't_ do this in the
 				// expected error case because we want to verify the error closes the
 				// stream from server side.
@ -726,20 +736,20 @@ func TestServer_StreamAggregatedResources_IngressEmptyResponse(t *testing.T) {

 	emptyClusterJSON := `{
 		"versionInfo": "` + hexString(1) + `",
-		"resources": [],
 		"typeUrl": "type.googleapis.com/envoy.api.v2.Cluster",
+		"resources": [],
 		"nonce": "` + hexString(1) + `"
 		}`
 	emptyListenerJSON := `{
 		"versionInfo": "` + hexString(1) + `",
-		"resources": [],
 		"typeUrl": "type.googleapis.com/envoy.api.v2.Listener",
+		"resources": [],
 		"nonce": "` + hexString(2) + `"
 		}`
 	emptyRouteJSON := `{
 		"versionInfo": "` + hexString(1) + `",
-		"resources": [],
 		"typeUrl": "type.googleapis.com/envoy.api.v2.RouteConfiguration",
+		"resources": [],
 		"nonce": "` + hexString(3) + `"
 		}`

--- a/agent/xds/testdata/clusters/connect-proxy-lb-in-resolver.envoy-1-13-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-lb-in-resolver.envoy-1-13-x.golden
@ -1,175 +0,0 @@
-{
-  "versionInfo": "00000001",
-  "resources": [
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "altStatName": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "5s",
-      "lbPolicy": "RING_HASH",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "ringHashLbConfig": {
-        "minimumRingSize": "20",
-        "maximumRingSize": "30"
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
-        }
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "5s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "local_app",
-      "type": "STATIC",
-      "connectTimeout": "5s",
-      "loadAssignment": {
-        "clusterName": "local_app",
-        "endpoints": [
-          {
-            "lbEndpoints": [
-              {
-                "endpoint": {
-                  "address": {
-                    "socketAddress": {
-                      "address": "127.0.0.1",
-                      "portValue": 8080
-                    }
-                  }
-                }
-              }
-            ]
-          }
-        ]
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "something-else.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "altStatName": "something-else.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "5s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "something-else.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
-        }
-      }
-    }
-  ],
-  "typeUrl": "type.googleapis.com/envoy.api.v2.Cluster",
-  "nonce": "00000001"
-}
--- a/agent/xds/testdata/clusters/connect-proxy-lb-in-resolver.envoy-1-14-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-lb-in-resolver.envoy-1-14-x.golden
@ -18,7 +18,22 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "ringHashLbConfig": {
+        "minimumRingSize": "20",
+        "maximumRingSize": "30"
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -40,17 +55,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "ringHashLbConfig": {
-        "minimumRingSize": "20",
-        "maximumRingSize": "30"
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -69,7 +73,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -91,9 +101,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
@ -137,7 +145,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -159,13 +178,6 @@
            }
          },
          "sni": "something-else.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    }
--- a/agent/xds/testdata/clusters/connect-proxy-lb-in-resolver.envoy-1-15-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-lb-in-resolver.envoy-1-15-x.golden
@ -18,7 +18,22 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "ringHashLbConfig": {
+        "minimumRingSize": "20",
+        "maximumRingSize": "30"
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -40,17 +55,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "ringHashLbConfig": {
-        "minimumRingSize": "20",
-        "maximumRingSize": "30"
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -69,7 +73,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -91,9 +101,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
@ -137,7 +145,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -159,13 +178,6 @@
            }
          },
          "sni": "something-else.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    }
--- a/agent/xds/testdata/clusters/connect-proxy-lb-in-resolver.envoy-1-16-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-lb-in-resolver.envoy-1-16-x.golden
@ -18,7 +18,22 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "ringHashLbConfig": {
+        "minimumRingSize": "20",
+        "maximumRingSize": "30"
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -40,17 +55,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "ringHashLbConfig": {
-        "minimumRingSize": "20",
-        "maximumRingSize": "30"
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -69,7 +73,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -91,9 +101,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
@ -137,7 +145,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -159,13 +178,6 @@
            }
          },
          "sni": "something-else.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    }
--- a/agent/xds/testdata/clusters/connect-proxy-with-chain-and-failover.envoy-1-13-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-chain-and-failover.envoy-1-13-x.golden
@ -1,122 +0,0 @@
-{
-  "versionInfo": "00000001",
-  "resources": [
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "altStatName": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "33s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
-        }
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "5s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "local_app",
-      "type": "STATIC",
-      "connectTimeout": "5s",
-      "loadAssignment": {
-        "clusterName": "local_app",
-        "endpoints": [
-          {
-            "lbEndpoints": [
-              {
-                "endpoint": {
-                  "address": {
-                    "socketAddress": {
-                      "address": "127.0.0.1",
-                      "portValue": 8080
-                    }
-                  }
-                }
-              }
-            ]
-          }
-        ]
-      }
-    }
-  ],
-  "typeUrl": "type.googleapis.com/envoy.api.v2.Cluster",
-  "nonce": "00000001"
-}
--- a/agent/xds/testdata/clusters/connect-proxy-with-chain-and-failover.envoy-1-14-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-chain-and-failover.envoy-1-14-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-chain-and-failover.envoy-1-15-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-chain-and-failover.envoy-1-15-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-chain-and-failover.envoy-1-16-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-chain-and-failover.envoy-1-16-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-chain-and-overrides.envoy-1-13-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-chain-and-overrides.envoy-1-13-x.golden
@ -1,125 +0,0 @@
-{
-  "versionInfo": "00000001",
-  "resources": [
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "a236e964~db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "altStatName": "a236e964~db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "66s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "http2ProtocolOptions": {
-
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
-        }
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "5s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "local_app",
-      "type": "STATIC",
-      "connectTimeout": "5s",
-      "loadAssignment": {
-        "clusterName": "local_app",
-        "endpoints": [
-          {
-            "lbEndpoints": [
-              {
-                "endpoint": {
-                  "address": {
-                    "socketAddress": {
-                      "address": "127.0.0.1",
-                      "portValue": 8080
-                    }
-                  }
-                }
-              }
-            ]
-          }
-        ]
-      }
-    }
-  ],
-  "typeUrl": "type.googleapis.com/envoy.api.v2.Cluster",
-  "nonce": "00000001"
-}
--- a/agent/xds/testdata/clusters/connect-proxy-with-chain-and-overrides.envoy-1-14-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-chain-and-overrides.envoy-1-14-x.golden
@ -17,7 +17,21 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "http2ProtocolOptions": {
+
+      },
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,16 +53,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "http2ProtocolOptions": {
-
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -67,7 +71,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -89,9 +99,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-chain-and-overrides.envoy-1-15-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-chain-and-overrides.envoy-1-15-x.golden
@ -17,7 +17,21 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "http2ProtocolOptions": {
+
+      },
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,16 +53,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "http2ProtocolOptions": {
-
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -67,7 +71,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -89,9 +99,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-chain-and-overrides.envoy-1-16-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-chain-and-overrides.envoy-1-16-x.golden
@ -17,7 +17,21 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "http2ProtocolOptions": {
+
+      },
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,16 +53,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "http2ProtocolOptions": {
-
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -67,7 +71,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -89,9 +99,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-chain-external-sni.envoy-1-13-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-chain-external-sni.envoy-1-13-x.golden
@ -1,122 +0,0 @@
-{
-  "versionInfo": "00000001",
-  "resources": [
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "altStatName": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "33s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "db.some.other.service.mesh"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
-        }
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "5s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "local_app",
-      "type": "STATIC",
-      "connectTimeout": "5s",
-      "loadAssignment": {
-        "clusterName": "local_app",
-        "endpoints": [
-          {
-            "lbEndpoints": [
-              {
-                "endpoint": {
-                  "address": {
-                    "socketAddress": {
-                      "address": "127.0.0.1",
-                      "portValue": 8080
-                    }
-                  }
-                }
-              }
-            ]
-          }
-        ]
-      }
-    }
-  ],
-  "typeUrl": "type.googleapis.com/envoy.api.v2.Cluster",
-  "nonce": "00000001"
-}
--- a/agent/xds/testdata/clusters/connect-proxy-with-chain-external-sni.envoy-1-14-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-chain-external-sni.envoy-1-14-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.some.other.service.mesh"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-chain-external-sni.envoy-1-15-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-chain-external-sni.envoy-1-15-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.some.other.service.mesh"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-chain-external-sni.envoy-1-16-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-chain-external-sni.envoy-1-16-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.some.other.service.mesh"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-chain.envoy-1-13-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-chain.envoy-1-13-x.golden
@ -1,122 +0,0 @@
-{
-  "versionInfo": "00000001",
-  "resources": [
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "altStatName": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "33s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
-        }
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "5s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "local_app",
-      "type": "STATIC",
-      "connectTimeout": "5s",
-      "loadAssignment": {
-        "clusterName": "local_app",
-        "endpoints": [
-          {
-            "lbEndpoints": [
-              {
-                "endpoint": {
-                  "address": {
-                    "socketAddress": {
-                      "address": "127.0.0.1",
-                      "portValue": 8080
-                    }
-                  }
-                }
-              }
-            ]
-          }
-        ]
-      }
-    }
-  ],
-  "typeUrl": "type.googleapis.com/envoy.api.v2.Cluster",
-  "nonce": "00000001"
-}
--- a/agent/xds/testdata/clusters/connect-proxy-with-chain.envoy-1-14-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-chain.envoy-1-14-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-chain.envoy-1-15-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-chain.envoy-1-15-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-chain.envoy-1-16-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-chain.envoy-1-16-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-local-gateway-triggered.envoy-1-13-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-local-gateway-triggered.envoy-1-13-x.golden
@ -1,122 +0,0 @@
-{
-  "versionInfo": "00000001",
-  "resources": [
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "altStatName": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "33s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "db.default.dc3.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
-        }
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "5s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "local_app",
-      "type": "STATIC",
-      "connectTimeout": "5s",
-      "loadAssignment": {
-        "clusterName": "local_app",
-        "endpoints": [
-          {
-            "lbEndpoints": [
-              {
-                "endpoint": {
-                  "address": {
-                    "socketAddress": {
-                      "address": "127.0.0.1",
-                      "portValue": 8080
-                    }
-                  }
-                }
-              }
-            ]
-          }
-        ]
-      }
-    }
-  ],
-  "typeUrl": "type.googleapis.com/envoy.api.v2.Cluster",
-  "nonce": "00000001"
-}
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-local-gateway-triggered.envoy-1-14-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-local-gateway-triggered.envoy-1-14-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc3.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-local-gateway-triggered.envoy-1-15-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-local-gateway-triggered.envoy-1-15-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc3.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-local-gateway-triggered.envoy-1-16-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-local-gateway-triggered.envoy-1-16-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc3.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-local-gateway.envoy-1-13-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-local-gateway.envoy-1-13-x.golden
@ -1,122 +0,0 @@
-{
-  "versionInfo": "00000001",
-  "resources": [
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "altStatName": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "33s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
-        }
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "5s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "local_app",
-      "type": "STATIC",
-      "connectTimeout": "5s",
-      "loadAssignment": {
-        "clusterName": "local_app",
-        "endpoints": [
-          {
-            "lbEndpoints": [
-              {
-                "endpoint": {
-                  "address": {
-                    "socketAddress": {
-                      "address": "127.0.0.1",
-                      "portValue": 8080
-                    }
-                  }
-                }
-              }
-            ]
-          }
-        ]
-      }
-    }
-  ],
-  "typeUrl": "type.googleapis.com/envoy.api.v2.Cluster",
-  "nonce": "00000001"
-}
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-local-gateway.envoy-1-14-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-local-gateway.envoy-1-14-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-local-gateway.envoy-1-15-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-local-gateway.envoy-1-15-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-local-gateway.envoy-1-16-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-local-gateway.envoy-1-16-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-remote-gateway-triggered.envoy-1-13-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-remote-gateway-triggered.envoy-1-13-x.golden
@ -1,122 +0,0 @@
-{
-  "versionInfo": "00000001",
-  "resources": [
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "altStatName": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "33s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "db.default.dc3.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
-        }
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "5s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "local_app",
-      "type": "STATIC",
-      "connectTimeout": "5s",
-      "loadAssignment": {
-        "clusterName": "local_app",
-        "endpoints": [
-          {
-            "lbEndpoints": [
-              {
-                "endpoint": {
-                  "address": {
-                    "socketAddress": {
-                      "address": "127.0.0.1",
-                      "portValue": 8080
-                    }
-                  }
-                }
-              }
-            ]
-          }
-        ]
-      }
-    }
-  ],
-  "typeUrl": "type.googleapis.com/envoy.api.v2.Cluster",
-  "nonce": "00000001"
-}
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-remote-gateway-triggered.envoy-1-14-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-remote-gateway-triggered.envoy-1-14-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc3.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-remote-gateway-triggered.envoy-1-15-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-remote-gateway-triggered.envoy-1-15-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc3.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-remote-gateway-triggered.envoy-1-16-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-remote-gateway-triggered.envoy-1-16-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc3.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-remote-gateway.envoy-1-13-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-remote-gateway.envoy-1-13-x.golden
@ -1,122 +0,0 @@
-{
-  "versionInfo": "00000001",
-  "resources": [
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "altStatName": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "33s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
-        }
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "5s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "local_app",
-      "type": "STATIC",
-      "connectTimeout": "5s",
-      "loadAssignment": {
-        "clusterName": "local_app",
-        "endpoints": [
-          {
-            "lbEndpoints": [
-              {
-                "endpoint": {
-                  "address": {
-                    "socketAddress": {
-                      "address": "127.0.0.1",
-                      "portValue": 8080
-                    }
-                  }
-                }
-              }
-            ]
-          }
-        ]
-      }
-    }
-  ],
-  "typeUrl": "type.googleapis.com/envoy.api.v2.Cluster",
-  "nonce": "00000001"
-}
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-remote-gateway.envoy-1-14-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-remote-gateway.envoy-1-14-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-remote-gateway.envoy-1-15-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-remote-gateway.envoy-1-15-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-remote-gateway.envoy-1-16-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-remote-gateway.envoy-1-16-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-local-gateway-triggered.envoy-1-13-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-local-gateway-triggered.envoy-1-13-x.golden
@ -1,122 +0,0 @@
-{
-  "versionInfo": "00000001",
-  "resources": [
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "altStatName": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "33s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "db.default.dc2.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
-        }
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "5s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "local_app",
-      "type": "STATIC",
-      "connectTimeout": "5s",
-      "loadAssignment": {
-        "clusterName": "local_app",
-        "endpoints": [
-          {
-            "lbEndpoints": [
-              {
-                "endpoint": {
-                  "address": {
-                    "socketAddress": {
-                      "address": "127.0.0.1",
-                      "portValue": 8080
-                    }
-                  }
-                }
-              }
-            ]
-          }
-        ]
-      }
-    }
-  ],
-  "typeUrl": "type.googleapis.com/envoy.api.v2.Cluster",
-  "nonce": "00000001"
-}
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-local-gateway-triggered.envoy-1-14-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-local-gateway-triggered.envoy-1-14-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc2.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-local-gateway-triggered.envoy-1-15-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-local-gateway-triggered.envoy-1-15-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc2.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-local-gateway-triggered.envoy-1-16-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-local-gateway-triggered.envoy-1-16-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc2.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-local-gateway.envoy-1-13-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-local-gateway.envoy-1-13-x.golden
@ -1,122 +0,0 @@
-{
-  "versionInfo": "00000001",
-  "resources": [
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "altStatName": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "33s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
-        }
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "5s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "local_app",
-      "type": "STATIC",
-      "connectTimeout": "5s",
-      "loadAssignment": {
-        "clusterName": "local_app",
-        "endpoints": [
-          {
-            "lbEndpoints": [
-              {
-                "endpoint": {
-                  "address": {
-                    "socketAddress": {
-                      "address": "127.0.0.1",
-                      "portValue": 8080
-                    }
-                  }
-                }
-              }
-            ]
-          }
-        ]
-      }
-    }
-  ],
-  "typeUrl": "type.googleapis.com/envoy.api.v2.Cluster",
-  "nonce": "00000001"
-}
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-local-gateway.envoy-1-14-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-local-gateway.envoy-1-14-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-local-gateway.envoy-1-15-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-local-gateway.envoy-1-15-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-local-gateway.envoy-1-16-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-local-gateway.envoy-1-16-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-remote-gateway-triggered.envoy-1-13-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-remote-gateway-triggered.envoy-1-13-x.golden
@ -1,122 +0,0 @@
-{
-  "versionInfo": "00000001",
-  "resources": [
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "altStatName": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "33s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "db.default.dc2.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
-        }
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "5s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "local_app",
-      "type": "STATIC",
-      "connectTimeout": "5s",
-      "loadAssignment": {
-        "clusterName": "local_app",
-        "endpoints": [
-          {
-            "lbEndpoints": [
-              {
-                "endpoint": {
-                  "address": {
-                    "socketAddress": {
-                      "address": "127.0.0.1",
-                      "portValue": 8080
-                    }
-                  }
-                }
-              }
-            ]
-          }
-        ]
-      }
-    }
-  ],
-  "typeUrl": "type.googleapis.com/envoy.api.v2.Cluster",
-  "nonce": "00000001"
-}
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-remote-gateway-triggered.envoy-1-14-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-remote-gateway-triggered.envoy-1-14-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc2.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-remote-gateway-triggered.envoy-1-15-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-remote-gateway-triggered.envoy-1-15-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc2.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-remote-gateway-triggered.envoy-1-16-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-remote-gateway-triggered.envoy-1-16-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc2.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-remote-gateway.envoy-1-13-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-remote-gateway.envoy-1-13-x.golden
@ -1,122 +0,0 @@
-{
-  "versionInfo": "00000001",
-  "resources": [
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "altStatName": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "33s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
-        }
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "5s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "local_app",
-      "type": "STATIC",
-      "connectTimeout": "5s",
-      "loadAssignment": {
-        "clusterName": "local_app",
-        "endpoints": [
-          {
-            "lbEndpoints": [
-              {
-                "endpoint": {
-                  "address": {
-                    "socketAddress": {
-                      "address": "127.0.0.1",
-                      "portValue": 8080
-                    }
-                  }
-                }
-              }
-            ]
-          }
-        ]
-      }
-    }
-  ],
-  "typeUrl": "type.googleapis.com/envoy.api.v2.Cluster",
-  "nonce": "00000001"
-}
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-remote-gateway.envoy-1-14-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-remote-gateway.envoy-1-14-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-remote-gateway.envoy-1-15-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-remote-gateway.envoy-1-15-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-remote-gateway.envoy-1-16-x.golden
+++ b/agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-remote-gateway.envoy-1-16-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/custom-limits-max-connections-only.envoy-1-13-x.golden
+++ b/agent/xds/testdata/clusters/custom-limits-max-connections-only.envoy-1-13-x.golden
@ -1,130 +0,0 @@
-{
-  "versionInfo": "00000001",
-  "resources": [
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "altStatName": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "5s",
-      "circuitBreakers": {
-        "thresholds": [
-          {
-            "maxConnections": 500
-          }
-        ]
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
-        }
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "5s",
-      "circuitBreakers": {
-        "thresholds": [
-          {
-            "maxConnections": 500
-          }
-        ]
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "local_app",
-      "type": "STATIC",
-      "connectTimeout": "5s",
-      "loadAssignment": {
-        "clusterName": "local_app",
-        "endpoints": [
-          {
-            "lbEndpoints": [
-              {
-                "endpoint": {
-                  "address": {
-                    "socketAddress": {
-                      "address": "127.0.0.1",
-                      "portValue": 8080
-                    }
-                  }
-                }
-              }
-            ]
-          }
-        ]
-      }
-    }
-  ],
-  "typeUrl": "type.googleapis.com/envoy.api.v2.Cluster",
-  "nonce": "00000001"
-}
--- a/agent/xds/testdata/clusters/custom-limits-max-connections-only.envoy-1-14-x.golden
+++ b/agent/xds/testdata/clusters/custom-limits-max-connections-only.envoy-1-14-x.golden
@ -21,7 +21,18 @@
          }
        ]
      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -43,13 +54,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -72,7 +76,13 @@
          }
        ]
      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -94,9 +104,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/custom-limits-max-connections-only.envoy-1-15-x.golden
+++ b/agent/xds/testdata/clusters/custom-limits-max-connections-only.envoy-1-15-x.golden
@ -21,7 +21,18 @@
          }
        ]
      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -43,13 +54,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -72,7 +76,13 @@
          }
        ]
      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -94,9 +104,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/custom-limits-max-connections-only.envoy-1-16-x.golden
+++ b/agent/xds/testdata/clusters/custom-limits-max-connections-only.envoy-1-16-x.golden
@ -21,7 +21,18 @@
          }
        ]
      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -43,13 +54,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -72,7 +76,13 @@
          }
        ]
      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -94,9 +104,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/custom-limits-set-to-zero.envoy-1-13-x.golden
+++ b/agent/xds/testdata/clusters/custom-limits-set-to-zero.envoy-1-13-x.golden
@ -1,134 +0,0 @@
-{
-  "versionInfo": "00000001",
-  "resources": [
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "altStatName": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "5s",
-      "circuitBreakers": {
-        "thresholds": [
-          {
-            "maxConnections": 0,
-            "maxPendingRequests": 0,
-            "maxRequests": 0
-          }
-        ]
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
-        }
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "5s",
-      "circuitBreakers": {
-        "thresholds": [
-          {
-            "maxConnections": 0,
-            "maxPendingRequests": 0,
-            "maxRequests": 0
-          }
-        ]
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "local_app",
-      "type": "STATIC",
-      "connectTimeout": "5s",
-      "loadAssignment": {
-        "clusterName": "local_app",
-        "endpoints": [
-          {
-            "lbEndpoints": [
-              {
-                "endpoint": {
-                  "address": {
-                    "socketAddress": {
-                      "address": "127.0.0.1",
-                      "portValue": 8080
-                    }
-                  }
-                }
-              }
-            ]
-          }
-        ]
-      }
-    }
-  ],
-  "typeUrl": "type.googleapis.com/envoy.api.v2.Cluster",
-  "nonce": "00000001"
-}
--- a/agent/xds/testdata/clusters/custom-limits-set-to-zero.envoy-1-14-x.golden
+++ b/agent/xds/testdata/clusters/custom-limits-set-to-zero.envoy-1-14-x.golden
@ -23,7 +23,18 @@
          }
        ]
      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -45,13 +56,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -76,7 +80,13 @@
          }
        ]
      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -98,9 +108,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/custom-limits-set-to-zero.envoy-1-15-x.golden
+++ b/agent/xds/testdata/clusters/custom-limits-set-to-zero.envoy-1-15-x.golden
@ -23,7 +23,18 @@
          }
        ]
      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -45,13 +56,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -76,7 +80,13 @@
          }
        ]
      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -98,9 +108,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/custom-limits-set-to-zero.envoy-1-16-x.golden
+++ b/agent/xds/testdata/clusters/custom-limits-set-to-zero.envoy-1-16-x.golden
@ -23,7 +23,18 @@
          }
        ]
      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -45,13 +56,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -76,7 +80,13 @@
          }
        ]
      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -98,9 +108,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/custom-limits.envoy-1-13-x.golden
+++ b/agent/xds/testdata/clusters/custom-limits.envoy-1-13-x.golden
@ -1,134 +0,0 @@
-{
-  "versionInfo": "00000001",
-  "resources": [
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "altStatName": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "5s",
-      "circuitBreakers": {
-        "thresholds": [
-          {
-            "maxConnections": 500,
-            "maxPendingRequests": 600,
-            "maxRequests": 700
-          }
-        ]
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
-        }
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "5s",
-      "circuitBreakers": {
-        "thresholds": [
-          {
-            "maxConnections": 500,
-            "maxPendingRequests": 600,
-            "maxRequests": 700
-          }
-        ]
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "local_app",
-      "type": "STATIC",
-      "connectTimeout": "5s",
-      "loadAssignment": {
-        "clusterName": "local_app",
-        "endpoints": [
-          {
-            "lbEndpoints": [
-              {
-                "endpoint": {
-                  "address": {
-                    "socketAddress": {
-                      "address": "127.0.0.1",
-                      "portValue": 8080
-                    }
-                  }
-                }
-              }
-            ]
-          }
-        ]
-      }
-    }
-  ],
-  "typeUrl": "type.googleapis.com/envoy.api.v2.Cluster",
-  "nonce": "00000001"
-}
--- a/agent/xds/testdata/clusters/custom-limits.envoy-1-14-x.golden
+++ b/agent/xds/testdata/clusters/custom-limits.envoy-1-14-x.golden
@ -23,7 +23,18 @@
          }
        ]
      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -45,13 +56,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -76,7 +80,13 @@
          }
        ]
      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -98,9 +108,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/custom-limits.envoy-1-15-x.golden
+++ b/agent/xds/testdata/clusters/custom-limits.envoy-1-15-x.golden
@ -23,7 +23,18 @@
          }
        ]
      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -45,13 +56,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -76,7 +80,13 @@
          }
        ]
      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -98,9 +108,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/custom-limits.envoy-1-16-x.golden
+++ b/agent/xds/testdata/clusters/custom-limits.envoy-1-16-x.golden
@ -23,7 +23,18 @@
          }
        ]
      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -45,13 +56,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -76,7 +80,13 @@
          }
        ]
      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -98,9 +108,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/custom-local-app.envoy-1-13-x.golden
+++ b/agent/xds/testdata/clusters/custom-local-app.envoy-1-13-x.golden
@ -1,110 +0,0 @@
-{
-  "versionInfo": "00000001",
-  "resources": [
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "altStatName": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "5s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
-        }
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "5s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "mylocal",
-      "connectTimeout": "15s",
-      "hosts": [
-        {
-          "socketAddress": {
-            "address": "127.0.0.1",
-            "portValue": 8080
-          }
-        }
-      ]
-    }
-  ],
-  "typeUrl": "type.googleapis.com/envoy.api.v2.Cluster",
-  "nonce": "00000001"
-}
--- a/agent/xds/testdata/clusters/custom-local-app.envoy-1-14-x.golden
+++ b/agent/xds/testdata/clusters/custom-local-app.envoy-1-14-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/custom-local-app.envoy-1-15-x.golden
+++ b/agent/xds/testdata/clusters/custom-local-app.envoy-1-15-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/custom-local-app.envoy-1-16-x.golden
+++ b/agent/xds/testdata/clusters/custom-local-app.envoy-1-16-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/custom-timeouts.envoy-1-13-x.golden
+++ b/agent/xds/testdata/clusters/custom-timeouts.envoy-1-13-x.golden
@ -1,122 +0,0 @@
-{
-  "versionInfo": "00000001",
-  "resources": [
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "altStatName": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "5s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
-        }
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "5s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "local_app",
-      "type": "STATIC",
-      "connectTimeout": "1.234s",
-      "loadAssignment": {
-        "clusterName": "local_app",
-        "endpoints": [
-          {
-            "lbEndpoints": [
-              {
-                "endpoint": {
-                  "address": {
-                    "socketAddress": {
-                      "address": "127.0.0.1",
-                      "portValue": 8080
-                    }
-                  }
-                }
-              }
-            ]
-          }
-        ]
-      }
-    }
-  ],
-  "typeUrl": "type.googleapis.com/envoy.api.v2.Cluster",
-  "nonce": "00000001"
-}
--- a/agent/xds/testdata/clusters/custom-timeouts.envoy-1-14-x.golden
+++ b/agent/xds/testdata/clusters/custom-timeouts.envoy-1-14-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/custom-timeouts.envoy-1-15-x.golden
+++ b/agent/xds/testdata/clusters/custom-timeouts.envoy-1-15-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/custom-timeouts.envoy-1-16-x.golden
+++ b/agent/xds/testdata/clusters/custom-timeouts.envoy-1-16-x.golden
@ -17,7 +17,18 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {
+
+        }
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -39,13 +50,6 @@
            }
          },
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      },
-      "commonLbConfig": {
-        "healthyPanicThreshold": {
-
        }
      }
    },
@ -64,7 +68,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -86,9 +96,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
--- a/agent/xds/testdata/clusters/custom-upstream-default-chain.envoy-1-13-x.golden
+++ b/agent/xds/testdata/clusters/custom-upstream-default-chain.envoy-1-13-x.golden
@ -1,110 +0,0 @@
-{
-  "versionInfo": "00000001",
-  "resources": [
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul",
-      "type": "EDS",
-      "edsClusterConfig": {
-        "edsConfig": {
-          "ads": {
-
-          }
-        }
-      },
-      "connectTimeout": "5s",
-      "circuitBreakers": {
-
-      },
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "local_app",
-      "type": "STATIC",
-      "connectTimeout": "5s",
-      "loadAssignment": {
-        "clusterName": "local_app",
-        "endpoints": [
-          {
-            "lbEndpoints": [
-              {
-                "endpoint": {
-                  "address": {
-                    "socketAddress": {
-                      "address": "127.0.0.1",
-                      "portValue": 8080
-                    }
-                  }
-                }
-              }
-            ]
-          }
-        ]
-      }
-    },
-    {
-      "@type": "type.googleapis.com/envoy.api.v2.Cluster",
-      "name": "myservice",
-      "connectTimeout": "15s",
-      "hosts": [
-        {
-          "socketAddress": {
-            "address": "127.0.0.1",
-            "portValue": 8080
-          }
-        }
-      ],
-      "tlsContext": {
-        "commonTlsContext": {
-          "tlsParams": {
-
-          },
-          "tlsCertificates": [
-            {
-              "certificateChain": {
-                "inlineString": "-----BEGIN CERTIFICATE-----\nMIICjDCCAjKgAwIBAgIIC5llxGV1gB8wCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowDjEMMAoG\nA1UEAxMDd2ViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEADPv1RHVNRfa2VKR\nAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Favq5E0ivpNtv1QnFhxtPd7d5k4e+T7\nSkW1TaOCAXIwggFuMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcD\nAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBoBgNVHQ4EYQRfN2Q6MDc6ODc6M2E6\nNDA6MTk6NDc6YzM6NWE6YzA6YmE6NjI6ZGY6YWY6NGI6ZDQ6MDU6MjU6NzY6M2Q6\nNWE6OGQ6MTY6OGQ6Njc6NWU6MmU6YTA6MzQ6N2Q6ZGM6ZmYwagYDVR0jBGMwYYBf\nZDE6MTE6MTE6YWM6MmE6YmE6OTc6YjI6M2Y6YWM6N2I6YmQ6ZGE6YmU6YjE6OGE6\nZmM6OWE6YmE6YjU6YmM6ODM6ZTc6NWU6NDE6NmY6ZjI6NzM6OTU6NTg6MGM6ZGIw\nWQYDVR0RBFIwUIZOc3BpZmZlOi8vMTExMTExMTEtMjIyMi0zMzMzLTQ0NDQtNTU1\nNTU1NTU1NTU1LmNvbnN1bC9ucy9kZWZhdWx0L2RjL2RjMS9zdmMvd2ViMAoGCCqG\nSM49BAMCA0gAMEUCIGC3TTvvjj76KMrguVyFf4tjOqaSCRie3nmHMRNNRav7AiEA\npY0heYeK9A6iOLrzqxSerkXXQyj5e9bE4VgUnxgPU6g=\n-----END CERTIFICATE-----\n"
-              },
-              "privateKey": {
-                "inlineString": "-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMoTkpRggp3fqZzFKh82yS4LjtJI+XY+qX/7DefHFrtdoAoGCCqGSM49\nAwEHoUQDQgAEADPv1RHVNRfa2VKRAB16b6rZnEt7tuhaxCFpQXPj7M2omb0B9Fav\nq5E0ivpNtv1QnFhxtPd7d5k4e+T7SkW1TQ==\n-----END EC PRIVATE KEY-----\n"
-              }
-            }
-          ],
-          "validationContext": {
-            "trustedCa": {
-              "inlineString": "-----BEGIN CERTIFICATE-----\nMIICXDCCAgKgAwIBAgIICpZq70Z9LyUwCgYIKoZIzj0EAwIwFDESMBAGA1UEAxMJ\nVGVzdCBDQSAyMB4XDTE5MDMyMjEzNTgyNloXDTI5MDMyMjEzNTgyNlowFDESMBAG\nA1UEAxMJVGVzdCBDQSAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIhywH1gx\nAsMwuF3ukAI5YL2jFxH6Usnma1HFSfVyxbXX1/uoZEYrj8yCAtdU2yoHETyd+Zx2\nThhRLP79pYegCaOCATwwggE4MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTAD\nAQH/MGgGA1UdDgRhBF9kMToxMToxMTphYzoyYTpiYTo5NzpiMjozZjphYzo3Yjpi\nZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1ZTo0MTo2ZjpmMjo3\nMzo5NTo1ODowYzpkYjBqBgNVHSMEYzBhgF9kMToxMToxMTphYzoyYTpiYTo5Nzpi\nMjozZjphYzo3YjpiZDpkYTpiZTpiMTo4YTpmYzo5YTpiYTpiNTpiYzo4MzplNzo1\nZTo0MTo2ZjpmMjo3Mzo5NTo1ODowYzpkYjA/BgNVHREEODA2hjRzcGlmZmU6Ly8x\nMTExMTExMS0yMjIyLTMzMzMtNDQ0NC01NTU1NTU1NTU1NTUuY29uc3VsMAoGCCqG\nSM49BAMCA0gAMEUCICOY0i246rQHJt8o8Oya0D5PLL1FnmsQmQqIGCi31RwnAiEA\noR5f6Ku+cig2Il8T8LJujOp2/2A72QcHZA57B13y+8o=\n-----END CERTIFICATE-----\n"
-            }
-          }
-        },
-        "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
-      }
-    }
-  ],
-  "typeUrl": "type.googleapis.com/envoy.api.v2.Cluster",
-  "nonce": "00000001"
-}
--- a/agent/xds/testdata/clusters/custom-upstream-default-chain.envoy-1-14-x.golden
+++ b/agent/xds/testdata/clusters/custom-upstream-default-chain.envoy-1-14-x.golden
@ -16,7 +16,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -38,9 +44,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
@ -80,7 +84,10 @@
          }
        }
      ],
-      "tlsContext": {
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -104,6 +111,7 @@
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
        }
      }
+    }
  ],
  "typeUrl": "type.googleapis.com/envoy.api.v2.Cluster",
  "nonce": "00000001"
--- a/agent/xds/testdata/clusters/custom-upstream-default-chain.envoy-1-15-x.golden
+++ b/agent/xds/testdata/clusters/custom-upstream-default-chain.envoy-1-15-x.golden
@ -16,7 +16,13 @@
      "circuitBreakers": {

      },
-      "tlsContext": {
+      "outlierDetection": {
+
+      },
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -38,9 +44,7 @@
            }
          },
          "sni": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
-      },
-      "outlierDetection": {
-
+        }
      }
    },
    {
@ -80,7 +84,10 @@
          }
        }
      ],
-      "tlsContext": {
+      "transportSocket": {
+        "name": "tls",
+        "typedConfig": {
+          "@type": "type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext",
          "commonTlsContext": {
            "tlsParams": {

@ -104,6 +111,7 @@
          "sni": "db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
        }
      }
+    }
  ],
  "typeUrl": "type.googleapis.com/envoy.api.v2.Cluster",
  "nonce": "00000001"
--- a/Show More
+++ b/Show More