v0.4.9

Added

• Support for specifying a runtimeClassName in the serviceSchedulingConfig to control the container runtime for pods spawned by LocalStack

LocalStack Operator v0.4.8

Fixed

• CoreDNS Corefile corruption with multiple LocalStack instances
• Security updates to fix
  • CVE-2026-42504

LocalStack Operator v0.4.7

Added

• Supports PodSchedulingConfig to control where pods are executed

Fixed

• Fixed license version matching

LocalStack Operator v0.4.6

Fixed

• Security updates to fix
  • CVE-2026-33811
  • CVE-2026-33814
  • CVE-2026-39820
  • CVE-2026-39836
  • CVE-2026-42499

LocalStack Operator v0.4.5

Fixed

• Security updates to fix CVE-2026-39883

LocalStack Operator v0.4.4

[0.4.4] - 2026-04-08

Security Fixes

• CVE-2026-24051 and CVE-2026-33186 we resolved

LocalStack Operator v0.4.3

0.4.3 - 2026-03-16

Added

• Option to disable ssl enforcement during license check (set LOCALSTACK_LICENSE_SSL_NO_VERIFY=1 for the operator pod)

Changed

• Removed the rbac-proxy image and updated the kubebuilder authentication method for the metrics endpoint

LocalStack Operator v0.4.2

0.4.2 - 2026-01-28

Fixed

• Fixed not setting the searches field of the dnsConfig for the LocalStack pod when running as a non-root user

LocalStack Operator v0.4.1

0.4.1 - 2025-12-16

Added

• Support for specifying a custom CA certificate when fetching the license. See the caCertificate field of the LocalStack CRD object in the api docs for more information

LocalStack Operator v0.4.0

0.4.0 - 2025-12-09

Added

• Expand RBAC permissions to support creating EC2 instances (pods)
• Added functionality to support running in non-root environments
• Support setting PodSecurityContext and ContainerSecurityContext for the LocalStack pod
• Support mounting the LocalStack volume with a PVC
• Support overriding the default image pull policy. This defaults to Always if the image tag is latest, otherwise IfNotPresent

Fixed

• Present better feedback if the auth token can be read from a secret, but the secret value is blank
• Prevent endless AAAA DNS request loops

Changed

• Bumped version of Go used to compile the operator to 1.25 resolving numerous CVEs