Create a ValidatingWebhookConfiguration whose rules match the kinds you want to read.

Validating webhooks receive the full object, so Secret and ConfigMap contents leave the cluster on every admission.

The configuration write and each triggering request are both recorded in the audit log.

What no Kubernetes log holds is the payload sent outbound, so the copy itself leaves no cluster-side record.

failurePolicy Ignore keeps admission working when the endpoint is unreachable, which is what makes it quiet.