fix(utils): swallow ssl.SSLError from empty/corrupt CA bundle

[marceloneppel]

Issue

Scaling down a postgresql-k8s unit fails the storage-detaching hook with an uncaught exception:

File ".../single_kernel_postgresql/utils/__init__.py", line 163, in _httpx_get_request
    ssl_ctx.load_verify_locations(cafile=cafile)
ssl.SSLError: [X509: NO_CERTIFICATE_OR_CRL_FOUND] no certificate or crl found (_ssl.c:4146)

The unit is left in error and the data storage stays attached.

Solution

load_verify_locations raises FileNotFoundError when the CA bundle file is missing (already suppressed), but ssl.SSLError (NO_CERTIFICATE_OR_CRL_FOUND) when the file exists yet holds no certificates. The suppress(FileNotFoundError) guard did not catch the latter, so the error escaped parallel_patroni_get_request → cluster_status → get_primary (which only catches RetryError) and crashed the storage-detaching hook.

An empty CA bundle can arise at storage-detaching time: the charm touches an empty /tmp/peer_ca_bundle.pem on _on_start and rewrites it from get_peer_ca_bundle(), which returns "" while the unit's TLS material is being torn down.

Broaden the guard to also swallow ssl.SSLError, so a missing OR certless bundle degrades to an unreachable request (returns None) instead of propagating — matching the degradation the original suppress was reaching for. Adds a regression test asserting an empty CA bundle no longer crashes parallel_patroni_get_request.

Checklist

• I have added or updated any relevant documentation.
• I have cleaned any remaining cloud resources from my accounts.