code: func (r *NodeAuthorizer) authorizeReadNamespacedObject(nodeName string, startingType vertexType, attrs authorizer.Attributes) (authorizer.Decision, string, error) {
  	if attrs.GetVerb() != "get" && attrs.GetVerb() != "list" && attrs.GetVerb() != "watch" {
  		klog.V(2).Infof("NODE DENY: %s %#v", nodeName, attrs)
  		return authorizer.DecisionNoOpinion, "can only read resources of this type", nil
  	}
  	if len(attrs.GetSubresource()) > 0 {
  		klog.V(2).Infof("NODE DENY: %s %#v", nodeName, attrs)
  		return authorizer.DecisionNoOpinion, "cannot read subresource", nil
  	}
  	if len(attrs.GetNamespace()) == 0 {
  		klog.V(2).Infof("NODE DENY: %s %#v", nodeName, attrs)
  		return authorizer.DecisionNoOpinion, "can only read namespaced object of this type", nil
  	}
  	return r.authorize(nodeName, startingType, attrs)
  }
docs: // authorizeReadNamespacedObject authorizes "get", "list" and "watch" requests to single objects of a
  // specified types if they are related to the specified node.