GRPCRoute matching rules

[0xff-dev]

Kong was deployed through kubernetes-ingress-controller, and the grpcbin service was deployed. I did the following operations

1. Create two k8s services for grpcbin, namely grpcbin-auth and grpcbin-noauth
2. Add annotations konghq.com/protocol: grpcs to these two k8s services
3. Create a grpcroute route, the yaml is as follows

apiVersion: gateway.networking.k8s.io/v1
kind: GRPCRoute
metadata:
  name: grpcbin-auth-selector
spec:
  hostnames:
  - grpcbin-test.dev.com
  parentRefs:
  - group: gateway.networking.k8s.io
    kind: Gateway
    name: kong
    sectionName: grpc
  rules:
  - backendRefs:
    - group: ""
      kind: Service
      name: grpcbin-noauth
      port: 9001
      weight: 1
    matches:
    - headers:
      - name: aa
        type: Exact
        value: bb
      method:
        method: SayHello
        service: hello.HelloService
        type: Exact
  - backendRefs:
    - group: ""
      kind: Service
      name: grpcbin-auth
      port: 9001
      weight: 1

4. Create an apikey plugin and put it on the grpcbin-auth k8s service.
   Finally, the yaml of the grpcbin-auth service is as follows.

apiVersion: v1
kind: Service
metadata:
  annotations:
    konghq.com/plugins: grpcbin-key-auth
    konghq.com/protocol: grpcs
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","kind":"Service","metadata":{"annotations":{"konghq.com/protocol":"grpcs"},"labels":{"app":"grpcbin"},"name":"grpcbin-auth","namespace":"micros-system"},"spec":{"ports":[{"name":"plaintext","port":9000,"protocol":"TCP","targetPort":9000},{"name":"tls","port":9001,"protocol":"TCP","targetPort":9001}],"selector":{"app":"grpcbin"},"sessionAffinity":"None","type":"ClusterIP"}}
  creationTimestamp: "2024-09-18T06:12:26Z"
  labels:
    app: grpcbin
  name: grpcbin-auth
spec:
  clusterIP: 10.97.221.229
  clusterIPs:
  - 10.97.221.229
  internalTrafficPolicy: Cluster
  ipFamilies:
  - IPv4
  ipFamilyPolicy: SingleStack
  ports:
  - name: plaintext
    port: 9000
    protocol: TCP
    targetPort: 9000
  - name: tls
    port: 9001
    protocol: TCP
    targetPort: 9001
  selector:
    app: grpcbin
  sessionAffinity: None
  type: ClusterIP

5. Requested results

grpcurl -H "aa:bb" -d '{"greeting":"KONG"}' -insecure grpcbin-test.dev.com:443 hello.HelloService.SayHello
Error invoking method "hello.HelloService.SayHello": rpc error: code = Unauthenticated desc = failed to query for service descriptor "hello.HelloService": unexpected HTTP status code received from server: 401 (Unauthorized); malformed header: missing HTTP content-type


grpcurl  -H "apikey: consumer-2-password" -d '{"greeting":"KONG"}' -insecure grpcbin-test.dev.com:443 hello.HelloService.SayHello
{
  "reply": "hello KONG"
}

The effect I want to get is that if I access hello.HelloService.SayHello with header aa:bb then no authentication is required, otherwise authentication is required.
But after testing, But after testing, I found that even with header aa:bb, it returns 401.
I have read gateway-api.sigs.k8s.io about matches, But my test results don't feel very common sense.

So I would like to ask what is the route matching rule here and what should I do if I want to achieve the above?

Thanks to the kong community.