Skip to main content
Copy page
Version: STS 2026.11.0

About the STS Release

WSO2 Agent Manager 2026.11.0 is a short-term support (STS) release available to everyone for evaluation. You can download it from the WSO2 website or use your existing WSO2 subscription. Both options provide the registry credentials required for installation.

This page covers what you need before you install it with the k3d or On Your Environment guide.

STS and LTS Releases​

WSO2 introduces new features through short-term support (STS) releases before including them in the next long-term support (LTS) release. This allows you to evaluate and use new capabilities without waiting for the next LTS release.

  • Feature updates. STS updates include new features, as well as bug fixes and security fixes. LTS updates include only bug fixes and security fixes.
  • Aligned fixes. Each STS update also includes the fixes released for the corresponding LTS release.
  • Limited support period. An STS release is supported until the next LTS release becomes available. The next LTS release includes all features introduced in the STS release, so plan to migrate to it when it becomes available.
  • Date-based versioning. STS releases use a year-and-month-based version format, such as 2026.11.0, to distinguish them from LTS releases, which use versions such as 1.0.0.

Choose an STS release if you want early access to new features or need to use them before they become available in an LTS release. Choose an LTS release for deployments that prioritize long-term stability and a longer support period.

Get Your Registry Credentials​

How you get registry credentials depends on how you obtained Agent Manager.

Evaluation​

You don't need a subscription to evaluate Agent Manager. Download it from the WSO2 download page, and WSO2 emails you registry credentials, which are a username and a token. Wherever a command shows <project>, use wso2-agent-manager-evaluations.

Subscription​

With a WSO2 subscription, get your registry credentials from the WSO2 Customer Portal, under Settings → Registry Tokens. See Registry Token Management for how to create and manage them. Wherever a command shows <project>, use wso2-agent-manager.

The rest of this page calls the username and token your registry credentials.

Where the Release Comes From​

STS releases sit under sts/ on the registry, apart from the long-term support releases.

ArtifactLocationVersion
Helm chartsoci://registry.wso2.com/<project>/sts/helm-charts/<chart>2026.11.0 for the release, 2026.11.0-u<N> for update N
Agent Manager imagesregistry.wso2.com/<project>/sts/<image>2026.11.0 for the release, 2026.11.0.<N> for update N
API Platform gateway chart and imagesregistry.wso2.com/<project>/sts/helm-charts/gateway, registry.wso2.com/<project>/sts/gateway-controller, and registry.wso2.com/<project>/sts/gateway-runtime2026.10.0

Every artifact needs your registry credentials. The charts on the registry already point at its images, and they reference an image pull secret named wso2-registry-credentials. The Helm chart reference is generated from the charts' source and shows their public defaults, such as ghcr.io/wso2 image repositories and install commands; the charts published to the registry replace those with registry.wso2.com/<project>/sts/. The API Platform gateway is pulled with a second pull secret, wso2-gateway-registry-credentials, which the gateway operator also reads to pull the gateway chart. The instrumentation image (amp-python-instrumentation-provider) and third-party images, such as OpenChoreo, ThunderID, and cert-manager, still come from their public registries.

WSO2 publishes the 2026.11.0 release to the registry, followed by updates to it. The release is version 2026.11.0, and update N is version 2026.11.0-u<N>. For example, update 2 is 2026.11.0-u2, with chart version 2026.11.0-u2 and image tag 2026.11.0.2. This page calls either one your version. Install the newest published version, unless WSO2 asks you to install a particular one.

Always name the version

Helm treats an update such as 2026.11.0-u2 as a pre-release of 2026.11.0, so it ranks every update below the release. helm install and helm upgrade without --version, and version ranges in tools such as Argo CD or Flux, therefore resolve to 2026.11.0 and never to an update. Pass the exact version every time.

List the Published Versions​

To see which versions are published, list the tags of the wso2-agent-manager chart with ORAS. Helm cannot list the versions of a chart in an OCI registry, and helm list shows only the version installed in your cluster.

oras login registry.wso2.com
oras repo tags registry.wso2.com/<project>/sts/helm-charts/wso2-agent-manager | grep -v '\.sig$' | sort -V

oras login asks for your registry username and token. Run oras logout registry.wso2.com when you are done, so the login is not kept on your machine.

Without ORAS installed, run the same commands in a temporary container. Nothing is kept after it exits:

docker run --rm -it --entrypoint sh ghcr.io/oras-project/oras:v1.2.3 -c 'oras login registry.wso2.com && oras repo tags registry.wso2.com/<project>/sts/helm-charts/wso2-agent-manager | grep -v "\.sig$" | sort -V'

The list starts with the release, 2026.11.0, followed by its updates in order, so the last version is the newest. The .sig tags that grep removes are the signatures described in Verify Image Signatures.

Install on k3d​

One Command​

Run the subscription installer. It installs the newest published version:

curl -fsSL https://github.com/wso2/agent-manager/releases/download/amp/v2026.11.0/k3d-install-subscription.sh | bash -s -- --project <project>

To install a particular version, such as one WSO2 asked you to use, add --version:

curl -fsSL https://github.com/wso2/agent-manager/releases/download/amp/v2026.11.0/k3d-install-subscription.sh | bash -s -- --project <project> --version 2026.11.0-u2

The script asks for your registry username and token, and reads the token without echoing it. It then:

  1. Checks the k3d prerequisites: Docker running, and k3d, kubectl, Helm, curl, tar, and lsof installed.
  2. Signs in to registry.wso2.com with your credentials and finds your version: the one you named, or the newest one published.
  3. Downloads the 2026.11.0 release bundle from GitHub into ~/.wso2-agent-manager/subscription/<project>/<image tag>/. The bundle holds only the installer scripts and configuration; it contains no charts or images.
  4. Creates the amp-local cluster and installs Agent Manager, pulling every chart, Agent Manager image, and the API Platform gateway from registry.wso2.com/<project>/sts/.
OptionDescription
--projectwso2-agent-manager for a subscription, or wso2-agent-manager-evaluations for an evaluation. Without it, the script asks which one.
--versionInstall this version, such as 2026.11.0 or 2026.11.0-u2, instead of the newest. This installer only installs 2026.11.0 and its updates, and refuses a version of another release.
--download-onlyCheck the credentials, find the version, download the release bundle, print its location, and stop without installing. It also shows when a newer version is published.

To run the script without prompts, set the credentials first, as described in Provide the Credentials Without Prompts.

When the install finishes, it prints the Console URL, the admin sign-in, and the version it installed. Continue with Verify and Access the Platform.

Guided Install​

Follow the Guided Install tab of the k3d guide:

  • Step 5: Configuration Variables sets your version and registry, and signs Helm in to registry.wso2.com.
  • Phase 2 creates the wso2-registry-credentials and wso2-gateway-registry-credentials pull secrets before Agent Manager is installed, and installs the gateway operator. The operator chart comes from ghcr.io, and the gateway chart and images come from the registry.

Install on Your Environment​

Follow the On Your Environment guide:

  • Plan Your Deployment sets your version and registry, and signs Helm in to registry.wso2.com.
  • Phase 2 creates the wso2-registry-credentials and wso2-gateway-registry-credentials pull secrets before Agent Manager is installed, and installs the gateway operator. The operator chart comes from ghcr.io, and the gateway chart and images come from the registry.

Add an Environment​

Create environments with the command the Console's Create Environment drawer generates, the same as in the environment management guide. Each environment gets its own API Platform gateway, which also comes from the registry, so on a subscription install the command:

  1. Downloads the 2026.11.0 release bundle from GitHub into a temporary directory, and runs add-environment.sh from it.
  2. Points the script at the registry: the Agent Manager images, the API Platform gateway, and the gateway extension chart at your installed version.
  3. Asks for your registry username and token, signs Helm in to registry.wso2.com, and creates the wso2-registry-credentials and wso2-gateway-registry-credentials pull secrets in the new environment's namespaces.

Run it in a terminal, so the script can ask for the credentials. To run it without prompts, put AMP_REGISTRY_CREDENTIALS_FILE=~/amp-registry.creds in front of bash in the command, with the file from Provide the Credentials Without Prompts.

Provide the Credentials Without Prompts​

k3d-install-subscription.sh reads the credentials from AMP_REGISTRY_USERNAME and AMP_REGISTRY_PASSWORD, or from a file named by AMP_REGISTRY_CREDENTIALS_FILE. Keep them in a file that only you can read rather than on a command line, where they end up in your shell history:

cat > ~/amp-registry.creds <<'EOF'
AMP_REGISTRY_USERNAME='<username>'
AMP_REGISTRY_PASSWORD=<token>
EOF
chmod 600 ~/amp-registry.creds

Keep the single quotes around the username. A registry username can contain $, which a shell would otherwise expand.

curl -fsSL https://github.com/wso2/agent-manager/releases/download/amp/v2026.11.0/k3d-install-subscription.sh | AMP_REGISTRY_CREDENTIALS_FILE=~/amp-registry.creds bash -s -- --project <project>

Verify the Installation​

Check that the Agent Manager pods run images from the registry:

kubectl get pods -n wso2-amp -o jsonpath='{range .items[*]}{.spec.containers[*].image}{"\n"}{end}' | grep amp-
kubectl get pods -n openchoreo-observability-plane -o jsonpath='{range .items[*]}{.spec.containers[*].image}{"\n"}{end}' | grep amp-

Each image should start with registry.wso2.com/<project>/sts/. The instrumentation image that platform-hosted agents use stays on ghcr.io/wso2, which is expected.

Check that the gateway runs the 2026.10.0 images from the registry:

kubectl get pods -n openchoreo-data-plane -o jsonpath='{range .items[*]}{.spec.containers[*].image}{"\n"}{end}' | grep gateway-

To see which version is installed, check the chart version of the amp release:

helm list -n wso2-amp

Verify Image Signatures (Optional)​

WSO2 signs every Agent Manager image and Helm chart in the registry with cosign. To verify one, save the WSO2 public key as cosign.pub:

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw4rovhfVQqdUeXvtxxAl
3OKdNLNaUqiAlnb3zBxv7ITYCJXhXLByUk5wuKca6fr00d3NqwXoUeVARdrKMz5y
6a0QTLmM8CmD+l/ffGRqrNel23cdHkIi3wZFAJToHy+mFB6tYUoL6ieuEtLT+bFn
msBkucHBPp6ahicCVPfegiTWjSwBylnYSOPa9D/VmvQV13ROfuq1EgeejbCpepbc
9APj3pXjpFtOPWPBBYdofumqYj2sKR2y/V4yYl8mrEJon6SX3hBi5d0RXGNaFzdU
6D9rm4K6ZEEYX+l2uT+sHorTtI4e08KVOK7lU0VY4fiR+5Mh3FFKeLvF8KNMSYOZ
gQIDAQAB
-----END PUBLIC KEY-----

Sign in to the registry, then verify an image and a chart:

printf 'Registry username: ' && read -r AMP_REGISTRY_USERNAME
printf 'Registry token: ' && stty -echo && read -r AMP_REGISTRY_PASSWORD; stty echo; echo
printf '%s' "$AMP_REGISTRY_PASSWORD" | docker login registry.wso2.com --username "$AMP_REGISTRY_USERNAME" --password-stdin
cosign verify --key cosign.pub registry.wso2.com/<project>/sts/amp-api:<image tag>
cosign verify --key cosign.pub registry.wso2.com/<project>/sts/helm-charts/wso2-agent-manager:<chart version>

Use the image tag and chart version of your version from Where the Release Comes From. For update 2, they are 2026.11.0.2 and 2026.11.0-u2.

A valid signature prints the verified claims for the image or chart. An error means the artifact was not signed by WSO2 or has changed since it was signed.

Troubleshooting​

Helm Fails With 401 Unauthorized​

Helm is not signed in to registry.wso2.com. Run the helm registry login command from the Configuration Variables step again, and check your registry credentials.

Agent Manager Pods Stay in ImagePullBackOff​

Check the pod's events with kubectl describe pod. The usual causes are:

  • The wso2-registry-credentials secret is missing from that pod's namespace.
  • The secret was created for a registry host other than registry.wso2.com.
  • The username was not quoted when the secret or credentials file was created, so the shell expanded its $.

Gateway Pods Stay in ImagePullBackOff, or the Gateway Never Installs​

The gateway pulls with wso2-gateway-registry-credentials, not wso2-registry-credentials. Check that the secret exists in openchoreo-data-plane and in the namespace of each environment you added, and that it carries username and password keys as well as .dockerconfigjson: the gateway operator reads the plain keys to pull the gateway chart. On an evaluation, also check that GATEWAY_REGISTRY names wso2-agent-manager-evaluations in a guided install. The one-command installer and the Console's environment command set it automatically.