Creating an IngressRouteTCP without TLS

I'm trying to create a IngressRouteTCP that should connect to a kafka server with their binary protocol. Thus not HTTP/HTTPS. Just TCP.

I followed this thread in order to add a new tcp entrypoint. The Traefik Dashboard is accepting it and shows no error - if - I use HostSNI("*"). But if I add the FQDN again and remove the TLS section, I'm getting an error.

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteTCP
metadata:
  name: kafka-broker
  namespace: kafka
spec:
  entryPoints:
    - kafkatcp
  routes:
  - match: HostSNI(`kafka-broker.test.local`)
    services:
    - name: kafka-broker
      port: 9000
  #tls:
    #passthrough: true

This is the error that follow, when I remove the TLS section.

invalid rule: "HostSNI(`kafka-broker.test.local`)" , has HostSNI matcher, but no TLS on router

Any hints? Any code examples on how to add an IngressRouteTCP without TLS is appreciated.

Ah. I see, the SNI information is taken from the TLS. Thus, no TLS, no route by FQDN. Makes sense. Hence, the only way to route it is the port (entrypoint) if not using a Certificate.