Currently we request pod,node and service scopes in the TLS volume, which makes it very hard to bring your own credentials.