diff --git a/plugin/traffic/xds/client.go b/plugin/traffic/xds/client.go
index 783ffc82c..a8836aacf 100644
--- a/plugin/traffic/xds/client.go
+++ b/plugin/traffic/xds/client.go
@@ -57,12 +57,17 @@ func New(opts Options) (*Client, error) {
 	case opts.Config.BalancerName == "":
 		return nil, errors.New("xds: no xds_server name provided in options")
 	case opts.Config.Creds == nil:
-		return nil, errors.New("xds: no credentials provided in options")
+		fmt.Printf("%s\n", errors.New("xds: no credentials provided in options"))
 	case opts.Config.NodeProto == nil:
 		return nil, errors.New("xds: no node_proto provided in options")
 	}
 
-	dopts := append([]grpc.DialOption{opts.Config.Creds}, opts.DialOpts...)
+	var dopts []grpc.DialOption
+	if opts.Config.Creds == nil {
+		dopts = append([]grpc.DialOption{grpc.WithInsecure()}, opts.DialOpts...)
+	} else {
+		dopts = append([]grpc.DialOption{opts.Config.Creds}, opts.DialOpts...)
+	}
 	cc, err := grpc.Dial(opts.Config.BalancerName, dopts...)
 	if err != nil {
 		// An error from a non-blocking dial indicates something serious.
diff --git a/plugin/traffic/xds_bootstrap_insecure.json b/plugin/traffic/xds_bootstrap_insecure.json
new file mode 100644
index 000000000..1ec652a37
--- /dev/null
+++ b/plugin/traffic/xds_bootstrap_insecure.json
@@ -0,0 +1,11 @@
+{
+        "node": {
+                "id": "ENVOY_NODE_ID",
+                "metadata": {
+                    "TRAFFICDIRECTOR_GRPC_HOSTNAME": "trafficdirector"
+            }
+        },
+        "xds_servers" : [{
+                "server_uri": "localhost:18000"
+        }]
+}