code: func (r *NodeAuthorizer) authorizeLease(nodeName string, attrs authorizer.Attributes) (authorizer.Decision, string, error) {
  	// allowed verbs: get, create, update, patch, delete
  	verb := attrs.GetVerb()
  	if verb != "get" &&
  		verb != "create" &&
  		verb != "update" &&
  		verb != "patch" &&
  		verb != "delete" {
  		klog.V(2).Infof("NODE DENY: %s %#v", nodeName, attrs)
  		return authorizer.DecisionNoOpinion, "can only get, create, update, patch, or delete a node lease", nil
  	}
  
  	// the request must be against the system namespace reserved for node leases
  	if attrs.GetNamespace() != api.NamespaceNodeLease {
  		klog.V(2).Infof("NODE DENY: %s %#v", nodeName, attrs)
  		return authorizer.DecisionNoOpinion, fmt.Sprintf("can only access leases in the %q system namespace", api.NamespaceNodeLease), nil
  	}
  
  	// the request must come from a node with the same name as the lease
  	// note we skip this check for create, since the authorizer doesn't know the name on create
  	// the noderestriction admission plugin is capable of performing this check at create time
  	if verb != "create" && attrs.GetName() != nodeName {
  		klog.V(2).Infof("NODE DENY: %s %#v", nodeName, attrs)
  		return authorizer.DecisionNoOpinion, "can only access node lease with the same name as the requesting node", nil
  	}
  
  	return authorizer.DecisionAllow, "", nil
  }
docs: // authorizeLease authorizes node requests to coordination.k8s.io/leases.