Which domain does the Cilium toFQDNs pattern *.example.com match?

Answer: api.example.com

Explanation

In a Cilium matchPattern, * matches any characters except a dot, so *.example.com covers exactly one extra label. It doesn't match the bare example.com or a.b.example.com. The **. prefix, as in **.example.com, matches subdomains at any depth.