Radar: fix the Helm install steps and list container images per release

content/operate/radar/install.md

@@ -83,7 +83,7 @@ In that line, both `enabled` and `required` should read `true`. Search your logs
 
 ### Package and service names
 
-Radar's services and paths use an `mcm` prefix. The RPM is named `radar`, its services are `mcm-api` and `mcm-worker`, and its configuration lives in `/etc/mcm/`. Container images use a `radar-` prefix in both the Docker Compose bundle and the Helm chart: `radar-app`, `radar-worker`, and `radar-migrate`.
+Radar's services and paths use an `mcm` prefix. The RPM is named `radar`, its services are `mcm-api` and `mcm-worker`, and its configuration lives in `/etc/mcm/`. The Helm chart pulls one Docker Hub repository, `redislabs/radar`, and selects each component by tag: `app-v<version>`, `worker-v<version>`, and `migrate-v<version>`. The Docker Compose bundle's container images use a `radar-` prefix: `radar-app`, `radar-worker`, and `radar-migrate`.
 
 ## Install on RHEL with the RPM
 
@@ -216,19 +216,31 @@ helm repo add radar https://helm.redis.io/radar
 helm repo update radar
 ```
 
-If you install from a source checkout or from an air-gapped bundle instead, substitute `./helm/radar` or the bundle's `radar-*.tgz` file for `radar/radar` in the `helm install` commands below.
+The chart version matches the Radar version. Replace `<version>` in the commands with the release you install, such as `2026.9.5`, and use that release's container images. Each release's [release notes]({{< relref "/operate/radar/release-notes" >}}) list its chart version and images under **Downloads**.
 
-1. Create the database secret. Store the database connection string in a secret.
+To install from a chart package file instead, such as on a cluster with no internet access, substitute the `radar-<version>.tgz` file for `radar/radar` in the `helm install` commands. See [Install on an air-gapped host](#install-on-an-air-gapped-host).
+
+1. Create the namespace.
+
+   ```bash
+   kubectl create namespace radar
+   ```
+
+   <br>
+
+2. Create the database secret. Store the database connection string in a secret.
 
    ```bash
    kubectl create secret generic radar-db \
      --namespace radar \
      --from-literal=DATABASE_URL='postgres://radar:secret@postgres.example.com:5432/radar?sslmode=require'
    ```
 
+   The chart also needs the database hostname as `database.host`, separate from the connection string. It uses the hostname to wait for the database before it starts the API server, the worker, and the migration job. If your database listens on a port other than 5432, also set `database.port`.
+
    <br>
 
-2. Create the credentials secret. Generate the credential encryption key as a file and load it with `--from-file`.
+3. Create the credentials secret. Generate the credential encryption key as a file and load it with `--from-file`.
 
    ```bash
    head -c 32 /dev/urandom > kek.bin
@@ -248,41 +260,62 @@ If you install from a source checkout or from an air-gapped bundle instead, subs
 
    <br>
 
-3. Install the chart.
+4. Install the chart.
 
    ```bash
    helm install radar radar/radar \
+     --version <version> \
      --namespace radar \
-     --create-namespace \
+     --set database.host=postgres.example.com \
      --set database.existingSecret=radar-db \
      --set credentials.existingSecret=radar-credentials \
      --set ingress.enabled=true \
      --set ingress.className=nginx \
-     --set ingress.hosts[0].host=radar.example.com \
-     --set ingress.hosts[0].paths[0].path=/ \
-     --set ingress.hosts[0].paths[0].pathType=Prefix
+     --set 'ingress.hosts[0].host=radar.example.com' \
+     --set 'ingress.hosts[0].paths[0].path=/' \
+     --set 'ingress.hosts[0].paths[0].pathType=Prefix'
    ```
 
    With an external database, as configured here, the chart runs schema migration as a Kubernetes job before the API server and worker start. If you use the chart's bundled PostgreSQL container instead, migration instead runs after the API and worker pods start, so expect them to restart briefly until the migration job completes. Migrations apply forward only; there is no automated rollback.
 
-   **For a private or air-gapped registry**, override the image source.
+   **For a private or air-gapped registry**, mirror the images listed in the release notes for your version, keeping each image's repository path, then point the chart at your registry. Save these values to a file, such as `registry-values.yaml`, and add `-f registry-values.yaml` to the `helm install` command.
 
    ```yaml
+   image:
+     registry: registry.example.com
+   dbWaitInitContainer:
+     image:
+       repository: registry.example.com/library/busybox
    global:
-     imageRegistry: registry.example.com/redislabs
      imagePullSecrets:
        - name: registry-creds
    ```
 
+   Set `image.registry` rather than `global.imageRegistry`. In chart 2026.9.5 and earlier, `global.imageRegistry` does not apply to the Radar images, and the `busybox` image has no registry setting, so its repository includes the registry. If you use the chart's bundled PostgreSQL container, also set `postgresql.image.registry`.
+
+   In the same chart versions, the `helm test` pod doesn't receive `global.imagePullSecrets` and runs as the namespace's `default` service account. If your registry requires authentication, attach the pull secret to that service account so `helm test` can pull `busybox`. On OpenShift:
+
+   ```bash
+   oc secrets link default registry-creds --for=pull -n radar
+   ```
+
+   On Kubernetes:
+
+   ```bash
+   kubectl patch serviceaccount default -n radar \
+     -p '{"imagePullSecrets": [{"name": "registry-creds"}]}'
+   ```
+
    **For OpenShift**, use the OpenShift values file instead, which lets OpenShift assign namespace-scoped user IDs and switches the external access path from an ingress to a route. The file ships inside the chart, so extract it first.
 
    ```bash
-   helm pull radar/radar --untar --untardir .
+   helm pull radar/radar --version <version> --untar --untardir .
 
    helm install radar radar/radar \
+     --version <version> \
      --namespace radar \
-     --create-namespace \
      -f ./radar/values-openshift.yaml \
+     --set database.host=postgres.example.com \
      --set database.existingSecret=radar-db \
      --set credentials.existingSecret=radar-credentials \
      --set route.host=radar.apps.example.com
@@ -292,15 +325,15 @@ If you install from a source checkout or from an air-gapped bundle instead, subs
 
    <br>
 
-4. Verify the install.
+5. Verify the install.
 
    ```bash
    kubectl get pods -n radar
    kubectl get jobs -n radar -l app.kubernetes.io/component=migrate
    helm test radar --namespace radar
    ```
 
-   Expect a running API pod, a running worker pod, and a completed migration job. To check health without an external access path, use the following commands.
+   Expect a running API pod and a running worker pod. With an external database, Helm deletes the migration job once it succeeds, so the job is listed only while it runs or if it fails. With the bundled PostgreSQL container, the completed job stays listed for seven days by default. To check health without an external access path, use the following commands.
 
    ```bash
    kubectl port-forward -n radar svc/radar 8080:80
@@ -309,7 +342,7 @@ If you install from a source checkout or from an air-gapped bundle instead, subs
 
    <br>
 
-5. Provide remote access. 
+6. Provide remote access. 
 
    The API server and UI are served on port 80 of an in-cluster service. Expose it with an ingress, an OpenShift route, or a `LoadBalancer` service, and terminate TLS there.
 
@@ -371,7 +404,7 @@ Confirm you've replaced every sample value, especially the credential encryption
 
 Air-gapped installation uses the same three methods.
 
-Transfer the release artifacts to the target host or to an offline repository it can reach, then verify them:
+Transfer the release artifacts to the target host or to an offline repository it can reach. If they include a `radar-v<version>.SHA256SUMS` file, verify them:
 
 ```bash
 sha256sum -c radar-v<version>.SHA256SUMS
@@ -380,11 +413,44 @@ sha256sum -c radar-v<version>.SHA256SUMS
 | Method | What to transfer | How it installs |
 |---|---|---|
 | RPM | The `.rpm` and the dependency closure, including `postgresql-server` if the host has no offline PostgreSQL | `dnf install` from the local file |
-| Helm | `images.tar.gz`, the packaged chart, and the bundled values file | `docker load` the images onto the nodes, then install the chart |
+| Helm | The chart package, `radar-<version>.tgz`, and the container images listed in the release notes for your version | Copy the images into a registry the cluster can pull from, then install the chart from the package. See [Helm on an air-gapped cluster](#helm-on-an-air-gapped-cluster). |
 | Docker Compose | `images.tar.gz` and the Compose files | `docker load`, then `docker compose up` |
 
 Your PostgreSQL database and the clusters you plan to monitor still need to be reachable from the Radar host over the network.
 
+### Helm on an air-gapped cluster
+
+1. On a machine with internet access, download the chart package.
+
+   ```bash
+   helm repo add radar https://helm.redis.io/radar
+   helm pull radar/radar --version <version>
+   ```
+
+   The command saves `radar-<version>.tgz`, which includes `values-openshift.yaml`.
+
+   <br>
+
+2. Copy each image listed under **Downloads** in the [release notes]({{< relref "/operate/radar/release-notes" >}}) for your version into your registry, keeping its repository path. For example, with `skopeo`:
+
+   ```bash
+   skopeo copy --all \
+     docker://docker.io/redislabs/radar:app-v<version> \
+     docker://registry.example.com/redislabs/radar:app-v<version>
+   ```
+
+   The `--all` option copies every platform of a multi-platform image, such as `busybox`, rather than only the platform of the machine that runs the copy.
+
+   <br>
+
+3. Install from the package. Follow [Install on Kubernetes with Helm](#install-on-kubernetes-with-helm) without adding the Helm repository, substitute `./radar-<version>.tgz` for `radar/radar`, and add the registry values file. For OpenShift, extract the values file from the package instead of running `helm pull`:
+
+   ```bash
+   tar -xzf radar-<version>.tgz radar/values-openshift.yaml
+   ```
+
+   <br>
+
 ## Next steps
 
 Radar is installed but has nothing to show yet. Continue to [Connect clusters]({{< relref "/operate/radar/connect" >}}) to add your first cluster.

content/operate/radar/release-notes/2026-9-2.md

@@ -46,3 +46,19 @@ See [Manage access]({{< relref "/operate/radar/manage-access" >}}).
 - Three install methods — **RPM** (RHEL 9), **Helm** (Kubernetes and OpenShift), and **Docker Compose** — from the same release artifacts.
 - Air-gapped installation supported for all three methods.
 See [Install Radar]({{< relref "/operate/radar/install" >}}).
+
+## Downloads
+
+- **Helm chart**: `radar` version `2026.9.2`, from the Redis Helm repository at `https://helm.redis.io/radar`
+
+### Container images
+
+The Helm chart pulls these images from Docker Hub. For an [air-gapped install]({{< relref "/operate/radar/install" >}}#install-on-an-air-gapped-host), mirror each one to a registry your cluster can reach.
+
+- **API server**: `redislabs/radar:app-v2026.9.2`
+- **Worker**: `redislabs/radar:worker-v2026.9.2`
+- **Migration job**: `redislabs/radar:migrate-v2026.9.2`
+- **Database wait and Helm test**: `library/busybox:1.37`
+- **Bundled PostgreSQL**, only if you enable it: `library/postgres:18.4-bookworm`
+
+The Radar images are built for `linux/amd64` only.

content/operate/radar/release-notes/2026-9-5.md

@@ -27,3 +27,19 @@ This is a Short-Term Support (STS) release. See [Self-managed releases]({{< relr
 - Track every agent under **Settings > Agents** and in the **Connected agents** list on the Connections page, with its mode, platform, version, and last heartbeat.
 
 Radar accepts agent connections on its agent gRPC endpoint, which isn't enabled on every Radar deployment. See [Connect clusters with an agent]({{< relref "/operate/radar/agent" >}}).
+
+## Downloads
+
+- **Helm chart**: `radar` version `2026.9.5`, from the Redis Helm repository at `https://helm.redis.io/radar`
+
+### Container images
+
+The Helm chart pulls these images from Docker Hub. For an [air-gapped install]({{< relref "/operate/radar/install" >}}#install-on-an-air-gapped-host), mirror each one to a registry your cluster can reach.
+
+- **API server**: `redislabs/radar:app-v2026.9.5`
+- **Worker**: `redislabs/radar:worker-v2026.9.5`
+- **Migration job**: `redislabs/radar:migrate-v2026.9.5`
+- **Database wait and Helm test**: `library/busybox:1.37`
+- **Bundled PostgreSQL**, only if you enable it: `library/postgres:18.4-bookworm`
+
+The Radar images are built for `linux/amd64` only.

content/operate/radar/release-notes/_index.md

@@ -23,7 +23,7 @@ Cloud releases roll out automatically on a regular basis, so there's nothing to
 
 ## Self-managed releases
 
-Self-managed Radar ships as a Helm chart, an RPM, and a Docker Compose bundle, as described in [Install Radar]({{< relref "/operate/radar/install" >}}). Get the RPM from the [Redis Download Center](https://cloud.redis.io/#/rlec-downloads), under **Modules, tools and integrations**, the container images from Docker Hub, and the Helm chart.
+Self-managed Radar ships as a Helm chart, an RPM, and a Docker Compose bundle, as described in [Install Radar]({{< relref "/operate/radar/install" >}}). Get the RPM from the [Redis Download Center](https://cloud.redis.io/#/rlec-downloads), under **Modules, tools and integrations**, the container images from Docker Hub, and the Helm chart from the Redis Helm repository at `https://helm.redis.io/radar`. Each release's notes list the exact chart version and container images under **Downloads**.
 
 Radar ships on two support tracks: