Without a render store, status reports a rollback that did not occur

Behavior#

A rollback applies the last healthy render. convoy reads that render from the render store. Without a render store (no --render-store-url), convoy has no stored render, so it cannot roll back. This part is the expected behavior.

The defect is in the status. When a rollout fails and spec.failurePolicy.rollback is not Never:

1. convoy selects a rollback, because status.lastHealthy is set. It does not check for a render store.
2. The rollback step finds no render store and does nothing.
3. convoy still writes rollout state RolledBack and Applied=True with reason RolledBack.

The same report appears when a render store is configured, but convoy cannot read or apply the last healthy render. convoy then does not retry with backoff. It tries again at the next periodic reconcile.

Effect#

The status says that the Release rolled back. The cluster still runs the failed render. InSync can read True, because the observer compares the cluster with the failed render.

Workaround#

• Configure a render store on convoy-controller-manager and convoy-observer (the same --render-store-url on both).
• Or set spec.failurePolicy.rollback: Never when convoy runs without a render store.

Fix direction#

• Report that a rollback is not possible: rollout state Failed and a dedicated reason that names the missing render store.
• Make a rollback value other than Never require a render store.