Update service-accounts-admin.md

Author: dprotaso

content/en/docs/reference/access-authn-authz/service-accounts-admin.md

@@ -98,7 +98,8 @@ each source also represents a single path within that volume. The three sources
 
 1. A `serviceAccountToken` source, that contains a token that the kubelet acquires from kube-apiserver.
    The kubelet fetches time-bound tokens using the TokenRequest API. A token served for a TokenRequest expires
-   either when the pod is deleted or after a defined lifespan (by default, that is 1 hour).
+   either when the pod is deleted or after a defined lifespan (by default, that is 1 hour). The token
+   will be refreshed by the kubelet prior to expiry.
    The token is bound to the specific Pod and has the kube-apiserver as its audience.
    This mechanism superseded an earlier mechanism that added a volume based on a Secret,
    where the Secret represented the ServiceAccount for the Pod, but did not expire.