fix beta criteria and add detail about cache invalidation

Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Author: aramase

keps/sig-auth/4412-projected-service-account-tokens-for-kubelet-image-credential-providers/README.md

@@ -507,7 +507,7 @@ Notes from reviewing the current KEP and discussion with @stlaz:
       1. I think it'll just be tied to the KSA and not so much to the expiry of the token because we're doing the same thing with image pull secrets (considered valid until deleted and recreated). Deletion and recreation of KSA will result in change in UID and that'll result in KSA not found in cache for the image (assuming the key used to store in cache is consistent with the cache key used in the credential provider cache that takes UID into consideration). Need to share the cache key generation logic to be consistent.
 3. Need an update to `ImagePullCredentials` struct to also store coordinates of the KSA.
 
-Until the two implementations are updated to work together, the alpha implementation of this KEP will use the KSA token based flow unless the pod is using image pull policy set to `Always`. This keeps the feature from misbehaving until we fix the implementations.
+Until the two implementations are updated to work together, the alpha implementation of this KEP will use the KSA token based flow only the pod is using image pull policy set to `Always`. This keeps the feature from misbehaving until we fix the implementations.
 
 ### Test Plan
 
@@ -674,7 +674,7 @@ in back-to-back releases.
 
 #### Beta
 
-- The implementation works well with the Ensure secret pull images KEP and supports pod image pull policy set to `Always`
+- The implementation works well with the Ensure secret pull images KEP and supports pod image pull policy set to any value.
 - Add metrics
 
 #### GA
@@ -804,6 +804,8 @@ NOTE: Also set `disable-supported` to `true` or `false` in `kep.yaml`.
 Yes. The feature flag needs to be disabled and the credential provider configuration for the provider that is using service account tokens for image pull
 needs to be updated to not use the `TokenAttributes` field or the provider needs to be removed.
 
+Kubelet needs to be restarted to invalidate the in-memory cache after removing the provider or updating the configuration.
+
 Steps to disable the feature:
 
 1. Update the kubelet credential provider configuration to remove providers that are using service account tokens for image pull.