xeol-operator

Is end-of-life software still running in your cluster? xeol-operator scans every running image. It finds runtimes, databases, frameworks and distros past end of life, and optionally known CVEs. Then it shows you which workloads to fix first.

Quick start View on GitHub

helm repo add xeol-operator https://rishang.github.io/xeol-operator
helm install xeol-operator xeol-operator/xeol-operator -n xeol-system --create-namespace

Every running workload

You see what your Pods really run, by image digest, not what a manifest claims. Private registries work with the Pods’ own pull secrets.

Dates, not labels

Every finding has its EOL date and the days left. So “due within 90 days” is just a query. The EOL data is rebuilt daily from endoflife.date.

Known vulnerabilities too

Turn on trivy.enabled to check for CVEs too. Trivy reuses the SBOM (software bill of materials) from the EOL scan. There’s no second image pull, and it takes about 0.2 s and 150 MB per image. Hide CVEs you’ve accepted by ID or package.

Fits your stack

The chart ships Prometheus metrics, alert rules and Grafana dashboards. No Grafana? Use the built-in web page or the MCP tools.

Grafana

Grafana dashboard: workloads running EOL software, by namespace and workload, with each finding’s EOL date and days left

Built-in web page

Built-in web page: tiles, an EOL timeline, a sortable findings table, and workload and namespace summaries

Trivy tab: workloads with CRITICAL and HIGH vulnerabilities, counts by severity, vulnerable packages grouped by severity, and the vulnerabilities table