# xeol-operator

> Kubernetes operator that scans the images a cluster runs for end-of-life software (xeol) and known vulnerabilities (trivy), and exports the results as Prometheus metrics, a Grafana dashboard, a web page and MCP tools.

Facts an agent needs to operate xeol-operator:

- Install: `helm repo add xeol-operator https://rishang.github.io/xeol-operator` then `helm install xeol-operator xeol-operator/xeol-operator -n xeol-system --create-namespace`. Optional features are Helm values: `trivy.enabled` (vulnerabilities), `serviceMonitor.enabled`, `prometheusRule.enabled`, `grafanaDatasource.enabled`, `ui.enabled`, `mcp.enabled`.
- Scan settings live in one YAML config file (no CRD): the chart renders the `scanner.*` values into the ConfigMap `<release>-config`. Fields: namespaceSelector, excludeNamespaces, excludeImages, interval, workloadKinds, workloadLabels, ignoreProducts, ignoreVulnerabilities. Edits apply live without a restart; unknown keys are rejected and the previous config stays in use.
- Pod-level settings (workers, memory, timeouts, databases, scan types, UI, MCP) are Helm values that become operator flags; changing them rolls the pod.
- Read results (read-only, no auth) on port 8080 of the Service `<release>-metrics`, via `kubectl port-forward`: `/api/v1/status`, `/api/v1/namespaces`, `/api/v1/workloads`, `/api/v1/findings` (EOL), `/api/v1/vulnerabilities` (with trivy), and Prometheus `/metrics`. Query parameters: namespace, kind, within_days, severity.
- Health: in `/api/v1/status`, `images_scanned` reaches `images_tracked`, `last_sweep` is set, `config_error` is empty, `db_age_seconds` is under a day or two.
- Accept a finding: add an `ignoreProducts` rule (by endoflife.date product, cycle) or an `ignoreVulnerabilities` rule (by CVE ID, package); both can be scoped by namespaces and a workload label selector.
- Rescan now: `kubectl -n xeol-system exec deploy/xeol-operator -- /manager rescan [image glob...]` (every running image without globs).
- MCP (`mcp.enabled`): Streamable HTTP at `/mcp`, read-only tools status, namespaces, workloads, findings; plus `rescan` only with `mcp.allowRescan`.
- Already EOL in PromQL: `xeol_eol_date_seconds < time()`; days left: `(xeol_eol_date_seconds - time()) / 86400`.

Pages:

- [Quick start](https://rishang.github.io/xeol-operator/quick-start/): install and first results.
- [Usage](https://rishang.github.io/xeol-operator/usage/): reading results, choosing what is scanned, accepting findings, alerts, private registries, rescan now, troubleshooting.
- [Configuration](https://rishang.github.io/xeol-operator/configuration/): every config file field, ignore rules, live reload, errors, tuning xeol and trivy, a full example.
- [Helm setup](https://rishang.github.io/xeol-operator/helm/): every chart value and feature.
- [Air-gapped installation](https://rishang.github.io/xeol-operator/air-gapped/): mounted databases, internal mirrors.
- [Architecture](https://rishang.github.io/xeol-operator/architecture/): how scans run, where data is stored, failure handling, security.

## Documentation Sets

- [Abridged documentation](https://rishang.github.io/xeol-operator/llms-small.txt): a compact version of the documentation for xeol-operator, with non-essential content removed
- [Complete documentation](https://rishang.github.io/xeol-operator/llms-full.txt): the full documentation for xeol-operator
- [Install and use](https://rishang.github.io/xeol-operator/_llms-txt/install-and-use.txt): install with Helm, check it works, read results (API, PromQL, web page, MCP), choose what is scanned, accept findings, alerts, private registries, rescan now, troubleshooting
- [Configuration and Helm reference](https://rishang.github.io/xeol-operator/_llms-txt/configuration-and-helm-reference.txt): every config file field and Helm value with defaults, ignore rules, live reload and errors, tuning xeol and trivy
- [Architecture and air-gapped](https://rishang.github.io/xeol-operator/_llms-txt/architecture-and-air-gapped.txt): components, scan flow, storage, failure handling, security; running without internet access

## Notes

- The complete documentation includes all content from the official documentation
- The content is automatically generated from the same source as the official documentation

## Optional

- [Source code](https://github.com/Rishang/xeol-operator): Go operator, Helm chart, these docs
- [Chart values.yaml](https://github.com/Rishang/xeol-operator/blob/main/helm/xeol-operator/values.yaml): every Helm value with comments