xeol-operator

Is end-of-life software still running in your cluster? Python 3.8, Node 16 and Alpine 3.18 are past end of life (EOL), but are any of your images still built on them?

xeol-operator scans every image running in your Kubernetes cluster, finds runtimes, databases, frameworks and distros that are past end of life or close to it, and shows you which workloads to fix first. Turn on trivy and the same scan also lists known vulnerabilities (CVEs). Results go to Grafana, Prometheus alerts, or a built-in web page.

Why use it

• Covers every running workload. It reads what Pods actually run (by image digest), not what a manifest claims. Private registries work with the Pods' own pull secrets.
• Gives dates, not just labels. Every finding has its EOL date and days left, so "due within 90 days" is just a query.
• Fits the tools you already have. It ships Prometheus metrics, ready-made alert rules and a Grafana dashboard with the Helm chart. Without Grafana, turn on the built-in web page or MCP tools for AI assistants.
• Uses EOL data that's kept up to date. It builds its database daily from endoflife.date, covering language runtimes, databases, frameworks and distros (Debian, Alpine, Ubuntu, ...).
• Finds CVEs too, at little extra cost. With trivy.enabled, trivy matches the SBOM already built for the EOL scan, so images aren't pulled twice. It adds about 0.2 s and 150 MB per image. CVEs you've accepted can be hidden by ID or package, like accepted EOL products.
• Is light to run. It's one read-only pod with no database or extra services, and it works in air-gapped clusters too.

Quick start

helm repo add xeol-operator https://rishang.github.io/xeol-operator
helm repo update

# With kube-prometheus-stack and Grafana (Infinity plugin):
helm install xeol-operator xeol-operator/xeol-operator -n xeol-system --create-namespace \
  --set serviceMonitor.enabled=true \
  --set prometheusRule.enabled=true \
  --set grafanaDatasource.enabled=true

kubectl -n xeol-system port-forward svc/xeol-operator-metrics 8080 &
curl -s localhost:8080/api/v1/status   # images_scanned, workloads_eol, last_sweep, ...

No Grafana? Use the built-in page instead:

helm install xeol-operator xeol-operator/xeol-operator -n xeol-system --create-namespace \
  --set ui.enabled=true --set mcp.enabled=true
kubectl -n xeol-system port-forward deploy/xeol-operator 8080
# open http://localhost:8080/

Ask an AI assistant over MCP:

claude mcp add --transport http xeol http://localhost:8080/mcp
# "Which workloads in prod run software that is already end of life?"

Vulnerability scanning (optional)

Add trivy to the same scan:

helm upgrade xeol-operator xeol-operator/xeol-operator -n xeol-system --reuse-values --set trivy.enabled=true

• syft builds each image's SBOM once; xeol reads it for EOL software and trivy sbom reads it for known vulnerabilities. The image isn't pulled again.
• The pod downloads trivy's database (~1.6 GB) at start and daily, and turns Ready once it has it. Scans never call out. Air-gapped clusters mount it instead (air-gapped installation).
• You get a second Grafana dashboard (xeol: vulnerabilities (trivy)), a Trivy tab on the web page, /api/v1/vulnerabilities, per-image counts in Prometheus and a stale-database alert.
• Only want vulnerabilities? Add --set eol.enabled=false. At least one scan type stays on.

The web page, MCP tools and JSON API are read-only and have no login: reach them with port-forward, and don't expose them through a public Ingress.

How it works

Each image is scanned once, no matter how many Pods run it, and rescanned every interval (default 24h). The numbered steps are explained in Architecture.

Alerts

With prometheusRule.enabled:

Alert	Fires when
XeolEOLSoftwareRunning	A running image contains software past EOL
XeolEOLSoftwareSoon	Software reaches EOL within 90 days (prometheusRule.eolSoonDays)
XeolDatabaseStale	The EOL database is older than 30 days
XeolDatabaseMissing	There is no EOL database, so nothing is scanned
XeolScanErrors	Images keep failing to scan
XeolVulnDatabaseStale	The trivy database is older than 7 days (trivy.enabled)

This is the beginning of the README. Read the rest at the original. Read the full README ↗