ccoctl tool produces scripts when run with the --dry-run option. These scrips contain errors.   

    Openshift Version 4.17.12

Always

    # extract the ccoctl tool from the release image per the docs.
    # use the ccotcl tool 
    # Create Key Pair
     ccoctl gcp create-key-pair --output-dir workloadfederation_dryrun/
     
    # Create identity pool and provider and service accounts.

    export PROJECT=openenv-d9nq6
    ccoctl gcp create-workload-identity-pool --name $PROJECT --project $PROJECT \
    --output-dir workloadfederation_dryrun  --dry-run
    ccoctl gcp create-workload-identity-provider  --name $PROJECT \
    --project $PROJECT --output-dir workloadfederation_dryrun  --dry-run \
    --workload-identity-pool  $PROJECT --region europe-west3 \
    --public-key-file workloadfederation_dryrun/serviceaccount-signer.public
    ccoctl gcp create-service-accounts   --credentials-requests-dir credentialrequests \ 
    --dry-run  --name $PROJECT  --project $PROJECT \
    --output-dir workloadfederation_dryrun   \
    --workload-identity-pool $PROJECT --workload-identity-provider $PROJECT}}

  
    

    Scripts are created in the output. These are not complete and contain errors.
1. There is a script missing to upload the jwks key file to the bucket.
2. The scripts to create the custom role do not work. (Syntax error on the gcloud command)
3. Some scripts need editing to work.