# About the STS Release WSO2 Agent Manager 2026.11.0 is a short-term support (STS) release available to everyone for evaluation. You can download it from the WSO2 website or use your existing WSO2 subscription. Both options provide the registry credentials required for installation. This page covers what you need before you install it with the [k3d](/agent-platform/docs/v2026.11.0/guides/on-k3d/.md) or [On Your Environment](/agent-platform/docs/v2026.11.0/guides/on-your-environment/.md) guide. ## STS and LTS Releases[​](#sts-and-lts-releases "Direct link to STS and LTS Releases") WSO2 introduces new features through short-term support (STS) releases before including them in the next long-term support (LTS) release. This allows you to evaluate and use new capabilities without waiting for the next LTS release. * **Feature updates.** STS updates include new features, as well as bug fixes and security fixes. LTS updates include only bug fixes and security fixes. * **Aligned fixes.** Each STS update also includes the fixes released for the corresponding LTS release. * **Limited support period.** An STS release is supported until the next LTS release becomes available. The next LTS release includes all features introduced in the STS release, so plan to migrate to it when it becomes available. * **Date-based versioning.** STS releases use a year-and-month-based version format, such as `2026.11.0`, to distinguish them from LTS releases, which use versions such as `1.0.0`. Choose an STS release if you want early access to new features or need to use them before they become available in an LTS release. Choose an LTS release for deployments that prioritize long-term stability and a longer support period. ## Get Your Registry Credentials[​](#get-your-registry-credentials "Direct link to Get Your Registry Credentials") How you get registry credentials depends on how you obtained Agent Manager. ### Evaluation[​](#evaluation "Direct link to Evaluation") You don't need a subscription to evaluate Agent Manager. Download it from the [WSO2 download page](https://wso2.com/products/downloads/?product=wso2agentmanager\&package=quickstart), and WSO2 emails you registry credentials, which are a username and a token. Wherever a command shows ``, use `wso2-agent-manager-evaluations`. ### Subscription[​](#subscription "Direct link to Subscription") With a WSO2 subscription, get your registry credentials from the WSO2 Customer Portal, under **Settings** → **Registry Tokens**. See [Registry Token Management](https://updates.docs.wso2.com/en/latest/updates/registry-token-management/) for how to create and manage them. Wherever a command shows ``, use `wso2-agent-manager`. The rest of this page calls the username and token your registry credentials. ## Where the Release Comes From[​](#where-the-release-comes-from "Direct link to Where the Release Comes From") STS releases sit under `sts/` on the registry, apart from the long-term support releases. | Artifact | Location | Version | | ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------- | | Helm charts | `oci://registry.wso2.com//sts/helm-charts/` | `2026.11.0` for the release, `2026.11.0-u` for update N | | Agent Manager images | `registry.wso2.com//sts/` | `2026.11.0` for the release, `2026.11.0.` for update N | | API Platform gateway chart and images | `registry.wso2.com//sts/helm-charts/gateway`, `registry.wso2.com//sts/gateway-controller`, and `registry.wso2.com//sts/gateway-runtime` | `2026.10.0` | Every artifact needs your registry credentials. The charts on the registry already point at its images, and they reference an image pull secret named `wso2-registry-credentials`. The [Helm chart reference](/agent-platform/docs/v2026.11.0/reference/helm-charts/.md) is generated from the charts' source and shows their public defaults, such as `ghcr.io/wso2` image repositories and install commands; the charts published to the registry replace those with `registry.wso2.com//sts/`. The API Platform gateway is pulled with a second pull secret, `wso2-gateway-registry-credentials`, which the gateway operator also reads to pull the gateway chart. The instrumentation image (`amp-python-instrumentation-provider`) and third-party images, such as OpenChoreo, ThunderID, and cert-manager, still come from their public registries. WSO2 publishes the 2026.11.0 release to the registry, followed by updates to it. The release is version `2026.11.0`, and update N is version `2026.11.0-u`. For example, update 2 is `2026.11.0-u2`, with chart version `2026.11.0-u2` and image tag `2026.11.0.2`. This page calls either one your version. Install the newest published version, unless WSO2 asks you to install a particular one. Always name the version Helm treats an update such as `2026.11.0-u2` as a pre-release of `2026.11.0`, so it ranks every update below the release. `helm install` and `helm upgrade` without `--version`, and version ranges in tools such as Argo CD or Flux, therefore resolve to `2026.11.0` and never to an update. Pass the exact version every time. ## List the Published Versions[​](#list-the-published-versions "Direct link to List the Published Versions") To see which versions are published, list the tags of the `wso2-agent-manager` chart with [ORAS](https://oras.land/). Helm cannot list the versions of a chart in an OCI registry, and `helm list` shows only the version installed in your cluster. ``` oras login registry.wso2.com oras repo tags registry.wso2.com//sts/helm-charts/wso2-agent-manager | grep -v '\.sig$' | sort -V ``` `oras login` asks for your registry username and token. Run `oras logout registry.wso2.com` when you are done, so the login is not kept on your machine. Without ORAS installed, run the same commands in a temporary container. Nothing is kept after it exits: ``` docker run --rm -it --entrypoint sh ghcr.io/oras-project/oras:v1.2.3 -c 'oras login registry.wso2.com && oras repo tags registry.wso2.com//sts/helm-charts/wso2-agent-manager | grep -v "\.sig$" | sort -V' ``` The list starts with the release, `2026.11.0`, followed by its updates in order, so the last version is the newest. The `.sig` tags that `grep` removes are the signatures described in [Verify Image Signatures](#verify-image-signatures-optional). ## Install on k3d[​](#install-on-k3d "Direct link to Install on k3d") ### One Command[​](#one-command "Direct link to One Command") Run the subscription installer. It installs the newest published version: ``` curl -fsSL https://github.com/wso2/agent-manager/releases/download/amp/v2026.11.0/k3d-install-subscription.sh | bash -s -- --project ``` To install a particular version, such as one WSO2 asked you to use, add `--version`: ``` curl -fsSL https://github.com/wso2/agent-manager/releases/download/amp/v2026.11.0/k3d-install-subscription.sh | bash -s -- --project --version 2026.11.0-u2 ``` The script asks for your registry username and token, and reads the token without echoing it. It then: 1. Checks the [k3d prerequisites](/agent-platform/docs/v2026.11.0/guides/on-k3d/.md#prerequisites): Docker running, and k3d, kubectl, Helm, curl, tar, and lsof installed. 2. Signs in to `registry.wso2.com` with your credentials and finds your version: the one you named, or the newest one published. 3. Downloads the 2026.11.0 release bundle from GitHub into `~/.wso2-agent-manager/subscription///`. The bundle holds only the installer scripts and configuration; it contains no charts or images. 4. Creates the `amp-local` cluster and installs Agent Manager, pulling every chart, Agent Manager image, and the API Platform gateway from `registry.wso2.com//sts/`. | Option | Description | | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `--project` | `wso2-agent-manager` for a subscription, or `wso2-agent-manager-evaluations` for an evaluation. Without it, the script asks which one. | | `--version` | Install this version, such as `2026.11.0` or `2026.11.0-u2`, instead of the newest. This installer only installs 2026.11.0 and its updates, and refuses a version of another release. | | `--download-only` | Check the credentials, find the version, download the release bundle, print its location, and stop without installing. It also shows when a newer version is published. | To run the script without prompts, set the credentials first, as described in [Provide the Credentials Without Prompts](#provide-the-credentials-without-prompts). When the install finishes, it prints the Console URL, the admin sign-in, and the version it installed. Continue with [Verify and Access the Platform](/agent-platform/docs/v2026.11.0/guides/on-k3d/.md#verify-and-access-the-platform). ### Guided Install[​](#guided-install "Direct link to Guided Install") Follow the **Guided Install** tab of the [k3d guide](/agent-platform/docs/v2026.11.0/guides/on-k3d/.md): * **Step 5: Configuration Variables** sets your version and registry, and signs Helm in to `registry.wso2.com`. * **Phase 2** creates the `wso2-registry-credentials` and `wso2-gateway-registry-credentials` pull secrets before Agent Manager is installed, and installs the gateway operator. The operator chart comes from `ghcr.io`, and the gateway chart and images come from the registry. ## Install on Your Environment[​](#install-on-your-environment "Direct link to Install on Your Environment") Follow the [On Your Environment](/agent-platform/docs/v2026.11.0/guides/on-your-environment/.md) guide: * **Plan Your Deployment** sets your version and registry, and signs Helm in to `registry.wso2.com`. * **Phase 2** creates the `wso2-registry-credentials` and `wso2-gateway-registry-credentials` pull secrets before Agent Manager is installed, and installs the gateway operator. The operator chart comes from `ghcr.io`, and the gateway chart and images come from the registry. ## Add an Environment[​](#add-an-environment "Direct link to Add an Environment") Create environments with the command the Console's **Create Environment** drawer generates, the same as in the [environment management guide](/agent-platform/docs/v2026.11.0/guides/environment-management/.md). Each environment gets its own API Platform gateway, which also comes from the registry, so on a subscription install the command: 1. Downloads the 2026.11.0 release bundle from GitHub into a temporary directory, and runs `add-environment.sh` from it. 2. Points the script at the registry: the Agent Manager images, the API Platform gateway, and the gateway extension chart at your installed version. 3. Asks for your registry username and token, signs Helm in to `registry.wso2.com`, and creates the `wso2-registry-credentials` and `wso2-gateway-registry-credentials` pull secrets in the new environment's namespaces. Run it in a terminal, so the script can ask for the credentials. To run it without prompts, put `AMP_REGISTRY_CREDENTIALS_FILE=~/amp-registry.creds` in front of `bash` in the command, with the file from [Provide the Credentials Without Prompts](#provide-the-credentials-without-prompts). ## Provide the Credentials Without Prompts[​](#provide-the-credentials-without-prompts "Direct link to Provide the Credentials Without Prompts") `k3d-install-subscription.sh` reads the credentials from `AMP_REGISTRY_USERNAME` and `AMP_REGISTRY_PASSWORD`, or from a file named by `AMP_REGISTRY_CREDENTIALS_FILE`. Keep them in a file that only you can read rather than on a command line, where they end up in your shell history: ``` cat > ~/amp-registry.creds <<'EOF' AMP_REGISTRY_USERNAME='' AMP_REGISTRY_PASSWORD= EOF chmod 600 ~/amp-registry.creds ``` Keep the single quotes around the username. A registry username can contain `$`, which a shell would otherwise expand. ``` curl -fsSL https://github.com/wso2/agent-manager/releases/download/amp/v2026.11.0/k3d-install-subscription.sh | AMP_REGISTRY_CREDENTIALS_FILE=~/amp-registry.creds bash -s -- --project ``` ## Verify the Installation[​](#verify-the-installation "Direct link to Verify the Installation") Check that the Agent Manager pods run images from the registry: ``` kubectl get pods -n wso2-amp -o jsonpath='{range .items[*]}{.spec.containers[*].image}{"\n"}{end}' | grep amp- kubectl get pods -n openchoreo-observability-plane -o jsonpath='{range .items[*]}{.spec.containers[*].image}{"\n"}{end}' | grep amp- ``` Each image should start with `registry.wso2.com//sts/`. The instrumentation image that platform-hosted agents use stays on `ghcr.io/wso2`, which is expected. Check that the gateway runs the `2026.10.0` images from the registry: ``` kubectl get pods -n openchoreo-data-plane -o jsonpath='{range .items[*]}{.spec.containers[*].image}{"\n"}{end}' | grep gateway- ``` To see which version is installed, check the chart version of the `amp` release: ``` helm list -n wso2-amp ``` ## Verify Image Signatures (Optional)[​](#verify-image-signatures-optional "Direct link to Verify Image Signatures (Optional)") WSO2 signs every Agent Manager image and Helm chart in the registry with [cosign](https://docs.sigstore.dev/cosign/). To verify one, save the WSO2 public key as `cosign.pub`: ``` -----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw4rovhfVQqdUeXvtxxAl 3OKdNLNaUqiAlnb3zBxv7ITYCJXhXLByUk5wuKca6fr00d3NqwXoUeVARdrKMz5y 6a0QTLmM8CmD+l/ffGRqrNel23cdHkIi3wZFAJToHy+mFB6tYUoL6ieuEtLT+bFn msBkucHBPp6ahicCVPfegiTWjSwBylnYSOPa9D/VmvQV13ROfuq1EgeejbCpepbc 9APj3pXjpFtOPWPBBYdofumqYj2sKR2y/V4yYl8mrEJon6SX3hBi5d0RXGNaFzdU 6D9rm4K6ZEEYX+l2uT+sHorTtI4e08KVOK7lU0VY4fiR+5Mh3FFKeLvF8KNMSYOZ gQIDAQAB -----END PUBLIC KEY----- ``` Sign in to the registry, then verify an image and a chart: ``` printf 'Registry username: ' && read -r AMP_REGISTRY_USERNAME printf 'Registry token: ' && stty -echo && read -r AMP_REGISTRY_PASSWORD; stty echo; echo printf '%s' "$AMP_REGISTRY_PASSWORD" | docker login registry.wso2.com --username "$AMP_REGISTRY_USERNAME" --password-stdin cosign verify --key cosign.pub registry.wso2.com//sts/amp-api: cosign verify --key cosign.pub registry.wso2.com//sts/helm-charts/wso2-agent-manager: ``` Use the image tag and chart version of your version from [Where the Release Comes From](#where-the-release-comes-from). For update 2, they are `2026.11.0.2` and `2026.11.0-u2`. A valid signature prints the verified claims for the image or chart. An error means the artifact was not signed by WSO2 or has changed since it was signed. ## Troubleshooting[​](#troubleshooting "Direct link to Troubleshooting") ### Helm Fails With 401 Unauthorized[​](#helm-fails-with-401-unauthorized "Direct link to Helm Fails With 401 Unauthorized") Helm is not signed in to `registry.wso2.com`. Run the `helm registry login` command from the Configuration Variables step again, and check your [registry credentials](#get-your-registry-credentials). ### Agent Manager Pods Stay in ImagePullBackOff[​](#agent-manager-pods-stay-in-imagepullbackoff "Direct link to Agent Manager Pods Stay in ImagePullBackOff") Check the pod's events with `kubectl describe pod`. The usual causes are: * The `wso2-registry-credentials` secret is missing from that pod's namespace. * The secret was created for a registry host other than `registry.wso2.com`. * The username was not quoted when the secret or credentials file was created, so the shell expanded its `$`. ### Gateway Pods Stay in ImagePullBackOff, or the Gateway Never Installs[​](#gateway-pods-stay-in-imagepullbackoff-or-the-gateway-never-installs "Direct link to Gateway Pods Stay in ImagePullBackOff, or the Gateway Never Installs") The gateway pulls with `wso2-gateway-registry-credentials`, not `wso2-registry-credentials`. Check that the secret exists in `openchoreo-data-plane` and in the namespace of each environment you added, and that it carries `username` and `password` keys as well as `.dockerconfigjson`: the gateway operator reads the plain keys to pull the gateway chart. On an evaluation, also check that `GATEWAY_REGISTRY` names `wso2-agent-manager-evaluations` in a guided install. The one-command installer and the Console's environment command set it automatically.