https://docs.redhat.com/en/documentation/red_hat_openstack_services_on_openshift/18.0/html/adopting_a_red_hat_openstack_platform_director_operator_environment/migrating-tls-everywhere_configuring-network

IPA_SSH is defined twice in the documentation, one for ssh to a freeipa server, the other if you are using a container. 
But the order does not make sense, 

IPA_SSH="podman exec -ti freeipa-server"

is set after trying to locate the CA certificate and key. 

It would make more sense to move the up to Prerequisites. 

Step 1 

IPA_SSH certutil -L -d /etc/pki/pki-tomcat/alias 

Should be 

$IPA_SSH certutil -L -d /etc/pki/pki-tomcat/alias 

In the Prerequisites we say log into the freeipa server as root, but this not something that would normally be recommended. 

It would probably be better to do something like this.

IPA_SSH="ssh -i <path_to_ssh_key> <admin user>@<freeipa-server-ip-address> sudo"