Okay the answer to this is that you can set spec.serviceAccountName on the dc and the secrets are mounted.
Annoyingly the same does not hold true for BuildConfig objects. They have an inconsistently named spec.serviceAccount. Setting that doesn’t mount any secrets associated with the sa. It also means your build isn’t an “image puller” until you explicitly set that up. So this configuration option appears pretty useless as at openshift 3.11.