I am mounting an OpenShift 3.11 secret into a container by virtue of this new section inside the container's element in `dc.spec.template.spec.containers:

volumeMounts:
- name: my-secret
  mountPath: /mnt/my-secret
  readOnly: true

and that new section into dc.spec.template.spec.containers:

volumes:
- name: my-secret
  secret:
    secretName: my-secret

My my-secret has been created from a private key like so:

oc create secret generic my-secret \
  --type=kubernetes.io/ssh-auth \
  --from-file=ssh-privatekey=my-private-key

At container runtime, I find the armored private key in a file /mnt/my-secret/ssh-privatekey. How can I ensure that only the UID which runs the container (a random UID under OpenShift rules) can read from that file, i.e. enforce a file mode akin to 0400?