code: func (m *Manager) requiresRefresh(tr *authenticationv1.TokenRequest) bool {
  	if tr.Spec.ExpirationSeconds == nil {
  		klog.Errorf("expiration seconds was nil for tr: %#v", tr)
  		return false
  	}
  	now := m.clock.Now()
  	exp := tr.Status.ExpirationTimestamp.Time
  	iat := exp.Add(-1 * time.Duration(*tr.Spec.ExpirationSeconds) * time.Second)
  
  	if now.After(iat.Add(maxTTL)) {
  		return true
  	}
  	// Require a refresh if within 20% of the TTL from the expiration time.
  	if now.After(exp.Add(-1 * time.Duration((*tr.Spec.ExpirationSeconds*20)/100) * time.Second)) {
  		return true
  	}
  	return false
  }
docs: // requiresRefresh returns true if the token is older than 80% of its total
  // ttl, or if the token is older than 24 hours.