IngressRoute targeting KubernetesAPI

I have some Port restrictions and would like to redirect KubernetesAPI requests (from ArgoCD) first to TraefikRoute (Port 443 on a k3s node) and then forward to localhost:6443.

How can I target a "host:port" instead of a pod-service?

ArgoCD (KubernetesAPI request) --- with TLS ---> Traefik (subdomain: eg. with TLS termination --- new TLS ---> localhost:6443

So easy solution if the target is a kubernetes service/pod. But how to achieve similar behavior targeting a host:port (in this case the kubernetes API of localhost)?

Terminating TLS (at Traefik IngressRoute) is desired because of certificate reasons.

Thanks for any advice/idea