create validatingwebhookconfigurations

Passive, cluster-wide data exfiltration with no Kubernetes audit trail.

A validating webhook receives a copy of every admitted object, including Secrets and ConfigMaps, before it's persisted.

Escalation Paths

Create a ValidatingWebhookConfiguration whose rules match the kinds you want to read.
Validating webhooks receive the full object, so Secret and ConfigMap contents leave the cluster on every admission.
The configuration write and each triggering request are both recorded in the audit log.
What no Kubernetes log holds is the payload sent outbound, so the copy itself leaves no cluster-side record.
failurePolicy Ignore keeps admission working when the endpoint is unreachable, which is what makes it quiet.

Additional rights needed:

none