{"id":"715931a14791dea6","repo":"docker/cli","slug":"s-flag-requires-the-rotate-flag-to-update","errorCode":null,"errorMessage":"`--%s` flag requires the `--rotate` flag to update the CA","messagePattern":"`--(.+?)` flag requires the `--rotate` flag to update the CA","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/swarm/ca.go","lineNumber":69,"sourceCode":"\tflags.Var(&opts.rootCAKey, flagCAKey, \"Path to the PEM-formatted root CA key to use for the new cluster\")\n\n\tflags.BoolVarP(&opts.detach, \"detach\", \"d\", false, \"Exit immediately instead of waiting for the root rotation to converge\")\n\tflags.BoolVarP(&opts.quiet, \"quiet\", \"q\", false, \"Suppress progress output\")\n\treturn cmd\n}\n\nfunc runCA(ctx context.Context, dockerCLI command.Cli, flags *pflag.FlagSet, opts caOptions) error {\n\tapiClient := dockerCLI.Client()\n\n\tres, err := apiClient.SwarmInspect(ctx, client.SwarmInspectOptions{})\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif !opts.rotate {\n\t\tfor _, f := range []string{flagCACert, flagCAKey, flagCertExpiry, flagExternalCA} {\n\t\t\tif flags.Changed(f) {\n\t\t\t\treturn fmt.Errorf(\"`--%s` flag requires the `--rotate` flag to update the CA\", f)\n\t\t\t}\n\t\t}\n\t\treturn displayTrustRoot(dockerCLI.Out(), res)\n\t}\n\n\tif flags.Changed(flagExternalCA) && len(opts.externalCA.Value()) > 0 && !flags.Changed(flagCACert) {\n\t\treturn fmt.Errorf(\n\t\t\t\"rotating to an external CA requires the `--%s` flag to specify the external CA's cert - \"+\n\t\t\t\t\"to add an external CA with the current root CA certificate, use the `update` command instead\", flagCACert)\n\t}\n\n\tif flags.Changed(flagCACert) && len(opts.externalCA.Value()) == 0 && !flags.Changed(flagCAKey) {\n\t\treturn fmt.Errorf(\"the --%s flag requires that a --%s flag and/or --%s flag be provided as well\",\n\t\t\tflagCACert, flagCAKey, flagExternalCA)\n\t}\n\n\tupdateSwarmSpec(&res.Swarm.Spec, flags, opts)\n\tif _, err := apiClient.SwarmUpdate(ctx, client.SwarmUpdateOptions{","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/docker/cli/blob/e9452d6e785f6e365712b9d71bd7517591773c86/cli/command/swarm/ca.go#L51-L87","documentation":"Error \"`--%s` flag requires the `--rotate` flag to update the CA\" thrown in docker/cli.","triggerScenarios":"Thrown at cli/command/swarm/ca.go:69 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"analyzedSha":"e9452d6e785f6e365712b9d71bd7517591773c86","analyzedAt":"2026-08-01T07:09:22.474Z","schemaVersion":2}